Partial measurement of reference signal for positioning resource

ABSTRACT

In an aspect, a wireless node (e.g., UE, gNB) performs a partial measurement of a measurement type (e.g., RSTD, Rx-Tx, etc.) of a reference signal for positioning (RS-P) resource (e.g., PRS, SRS) that includes multiple symbols, the partial measurement being measured across a subset of the multiple symbols. The wireless node transmits a measurement report that includes an indication of the first partial measurement. The communications device receives the measurement report, and determines whether a spoofing attack is associated with the RS-P based at least in part upon the measurement report.

BACKGROUND OF THE DISCLOSURE 1. Field of the Disclosure

Aspects of the disclosure relate generally to wireless communications.

2. Description of the Related Art

Wireless communication systems have developed through variousgenerations, including a first-generation analog wireless phone service(1G), a second-generation (2G) digital wireless phone service (includinginterim 2.5G and 2.75G networks), a third-generation (3G) high speeddata, Internet-capable wireless service and a fourth-generation (4G)service (e.g., Long Term Evolution (LTE) or WiMax). There are presentlymany different types of wireless communication systems in use, includingcellular and personal communications service (PCS) systems. Examples ofknown cellular systems include the cellular analog advanced mobile phonesystem (AMPS), and digital cellular systems based on code divisionmultiple access (CDMA), frequency division multiple access (FDMA), timedivision multiple access (TDMA), the Global System for Mobilecommunications (GSM), etc.

A fifth generation (5G) wireless standard, referred to as New Radio(NR), calls for higher data transfer speeds, greater numbers ofconnections, and better coverage, among other improvements. The 5Gstandard, according to the Next Generation Mobile Networks Alliance, isdesigned to provide data rates of several tens of megabits per second toeach of tens of thousands of users, with 1 gigabit per second to tens ofworkers on an office floor. Several hundreds of thousands ofsimultaneous connections should be supported in order to support largesensor deployments. Consequently, the spectral efficiency of 5G mobilecommunications should be significantly enhanced compared to the current4G standard. Furthermore, signaling efficiencies should be enhanced andlatency should be substantially reduced compared to current standards.

SUMMARY

The following presents a simplified summary relating to one or moreaspects disclosed herein. Thus, the following summary should not beconsidered an extensive overview relating to all contemplated aspects,nor should the following summary be considered to identify key orcritical elements relating to all contemplated aspects or to delineatethe scope associated with any particular aspect. Accordingly, thefollowing summary has the sole purpose to present certain conceptsrelating to one or more aspects relating to the mechanisms disclosedherein in a simplified form to precede the detailed descriptionpresented below.

In an aspect, a method of operating a wireless node includes performinga first partial measurement of a first measurement type of a referencesignal for positioning (RS-P) resource that includes multiple symbols,the first partial measurement being measured across a first subset ofthe multiple symbols; and transmitting a measurement report thatincludes an indication of the first partial measurement.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at an initial symbol of the RS-P resource.

In some aspects, the method includes performing a full measurement ofthe first measurement type of the RS-P resource, the full measurementbeing measured across all symbols of the RS-P resource.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the full measurement.

In some aspects, indications of the first partial measurement and thefull measurement are transmitted via separate measurement reports.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at a starting symbol that is later than aninitial symbol of the RS-P resource.

In some aspects, the method includes performing a second partialmeasurement of the first measurement type of the RS-P, the secondpartial measurement being measured across a second subset of themultiple symbols, the second subset of symbols being different than thefirst subset of symbols.

In some aspects, a number of the first subset of symbols is the same asa number of the second subset of symbols.

In some aspects, a number of the first subset of symbols is differentthan a number of the second subset of symbols.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the second partial measurement.

In some aspects, indications of the first partial measurement and thesecond partial measurement are transmitted via separate measurementreports.

In some aspects, the method includes determining whether a spoofingattack is associated with the RS-P based at least in part upon the firstpartial measurement.

In some aspects, the method includes performing at least one additionalpartial measurement of a second measurement type of the RS-P resource,the at least one additional partial measurement being measured across atleast one subset of symbols of the multiple symbols; and transmitting atleast one additional measurement report that includes at least oneadditional indication of the at least one additional partialmeasurement.

In some aspects, partial measurements of the first measurement type areperformed for multiple RS-Ps, and reporting of the partial measurementsis performed for less than all of the RS-Ps.

In some aspects, the reporting of the partial measurements is performedperiodically, aperiodically, or semi-periodically.

In some aspects, the measurement report is transmitted in response to anon-demand request.

In some aspects, the on-demand request is configured to request a singlepartial measurement indication or multiple partial measurementindications.

In some aspects, the on-demand request specifies a number of the firstsubset of symbols, a starting symbol of the first subset of symbols, ora combination thereof.

In some aspects, the measurement report includes an indication of thefirst subset of symbols.

In some aspects, the first measurement type corresponds to a referencesignal time difference (RSTD) measurement or a receive-transmit (Rx-Tx)time difference.

In some aspects, the wireless node corresponds to a base station or auser equipment (UE).

In some aspects, the RS-P corresponds to a downlink positioningreference signal (DL-PRS), an uplink sounding reference signal forpositioning (UL-SRS-P) or a sidelink PRS (SL-PRS).

In an aspect, a method of operating a communications device includesreceiving, from a wireless node, a measurement report that includes anindication of a first partial measurement of a first measurement type ofa reference signal for positioning (RS-P) resource that includesmultiple symbols, the first partial measurement being measured by thewireless node across a first subset of the multiple symbols; anddetermining whether a spoofing attack is associated with the RS-P basedat least in part upon the measurement report.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at an initial symbol of the RS-P resource.

In some aspects, the measurement report or a separate measurement reportincludes a full measurement of the first measurement type of the RS-Presource, the full measurement being measured by the wireless nodeacross all symbols of the RS-P resource.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the full measurement.

In some aspects, indications of the first partial measurement and thefull measurement are received via the measurement report and theseparate measurement report, respectively.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at a starting symbol that is later than aninitial symbol of the RS-P resource.

In some aspects, the measurement report or a separate measurement reportincludes an indication of a second partial measurement of the firstmeasurement type of the RS-P, the second partial measurement beingmeasured across a second subset of the multiple symbols, the secondsubset of symbols being different than the first subset of symbols.

In some aspects, a number of the first subset of symbols is the same asa number of the second subset of symbols.

In some aspects, a number of the first subset of symbols is differentthan a number of the second subset of symbols.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the second partial measurement.

In some aspects, indications of the first partial measurement and thesecond partial measurement are received via the measurement report andthe separate measurement report, respectively.

In some aspects, the method includes receiving at least one additionalmeasurement report comprising at least one additional indication of atleast one additional partial measurement of a second measurement type ofthe RS-P resource, the at least one additional partial measurement beingmeasured by the wireless node across at least one subset of symbols ofthe multiple symbols.

In some aspects, partial measurements of the first measurement type areperformed by the wireless node for multiple RS-Ps, and reporting of thepartial measurements is performed for less than all of the RS-Ps.

In some aspects, the reporting of the partial measurements is performedperiodically, aperiodically, or semi-periodically.

In some aspects, the measurement report is received in response to anon-demand request.

In some aspects, the on-demand request is configured to request a singlepartial measurement indication or multiple partial measurementindications.

In some aspects, the on-demand request specifies a number of the firstsubset of symbols, a starting symbol of the first subset of symbols, ora combination thereof.

In some aspects, the measurement report includes an indication of thefirst subset of symbols.

In some aspects, the first measurement type corresponds to a referencesignal time difference (RSTD) measurement or a receive-transmit (Rx-Tx)time difference.

In some aspects, the wireless node corresponds to a base station or auser equipment (UE).

In some aspects, the RS-P corresponds to a downlink positioningreference signal (DL-PRS), an uplink sounding reference signal forpositioning (UL-SRS-P) or a sidelink PRS (SL-PRS).

In an aspect, a wireless node includes a memory; a communicationinterface; and at least one processor communicatively coupled to thememory and the communication interface, the at least one processorconfigured to: perform a first partial measurement of a firstmeasurement type of a reference signal for positioning (RS-P) resourcethat includes multiple symbols, the first partial measurement beingmeasured across a first subset of the multiple symbols; and cause thecommunication interface to transmit a measurement report that includesan indication of the first partial measurement.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at an initial symbol of the RS-P resource.

In some aspects, the at least one processor is further configured to:perform a full measurement of the first measurement type of the RS-Presource, the full measurement being measured across all symbols of theRS-P resource.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the full measurement.

In some aspects, indications of the first partial measurement and thefull measurement are transmitted via separate measurement reports.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at a starting symbol that is later than aninitial symbol of the RS-P resource.

In some aspects, the at least one processor is further configured to:perform a second partial measurement of the first measurement type ofthe RS-P, the second partial measurement being measured across a secondsubset of the multiple symbols, the second subset of symbols beingdifferent than the first subset of symbols.

In some aspects, a number of the first subset of symbols is the same asa number of the second subset of symbols.

In some aspects, a number of the first subset of symbols is differentthan a number of the second subset of symbols.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the second partial measurement.

In some aspects, indications of the first partial measurement and thesecond partial measurement are transmitted via separate measurementreports.

In some aspects, the at least one processor is further configured to:determine whether a spoofing attack is associated with the RS-P based atleast in part upon the first partial measurement.

In some aspects, the at least one processor is further configured to:perform at least one additional partial measurement of a secondmeasurement type of the RS-P resource, the at least one additionalpartial measurement being measured across at least one subset of symbolsof the multiple symbols; and cause the communication interface totransmit at least one additional measurement report that includes atleast one additional indication of the at least one additional partialmeasurement.

In some aspects, partial measurements of the first measurement type areperformed for multiple RS-Ps, and reporting of the partial measurementsis performed for less than all of the RS-Ps.

In some aspects, the reporting of the partial measurements is performedperiodically, aperiodically, or semi-periodically.

In some aspects, the measurement report is transmitted in response to anon-demand request.

In some aspects, the on-demand request is configured to request a singlepartial measurement indication or multiple partial measurementindications.

In some aspects, the on-demand request specifies a number of the firstsubset of symbols, a starting symbol of the first subset of symbols, ora combination thereof.

In some aspects, the measurement report includes an indication of thefirst subset of symbols.

In some aspects, the first measurement type corresponds to a referencesignal time difference (RSTD) measurement or a receive-transmit (Rx-Tx)time difference.

In some aspects, the wireless node corresponds to a base station or auser equipment (UE).

In some aspects, the RS-P corresponds to a downlink positioningreference signal (DL-PRS), an uplink sounding reference signal forpositioning (UL-SRS-P) or a sidelink PRS (SL-PRS).

In an aspect, a communications device includes a memory; a communicationinterface; and at least one processor communicatively coupled to thememory and the communication interface, the at least one processorconfigured to: receive, via the communication interface, from a wirelessnode, a measurement report that includes an indication of a firstpartial measurement of a first measurement type of a reference signalfor positioning (RS-P) resource that includes multiple symbols, thefirst partial measurement being measured by the wireless node across afirst subset of the multiple symbols; and determine whether a spoofingattack is associated with the RS-P based at least in part upon themeasurement report.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at an initial symbol of the RS-P resource.

In some aspects, the measurement report or a separate measurement reportincludes a full measurement of the first measurement type of the RS-Presource, the full measurement being measured by the wireless nodeacross all symbols of the RS-P resource.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the full measurement.

In some aspects, indications of the first partial measurement and thefull measurement are received via the measurement report and theseparate measurement report, respectively.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at a starting symbol that is later than aninitial symbol of the RS-P resource.

In some aspects, the measurement report or a separate measurement reportincludes an indication of a second partial measurement of the firstmeasurement type of the RS-P, the second partial measurement beingmeasured across a second subset of the multiple symbols, the secondsubset of symbols being different than the first subset of symbols.

In some aspects, a number of the first subset of symbols is the same asa number of the second subset of symbols.

In some aspects, a number of the first subset of symbols is differentthan a number of the second subset of symbols.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the second partial measurement.

In some aspects, indications of the first partial measurement and thesecond partial measurement are received via the measurement report andthe separate measurement report, respectively.

In some aspects, the at least one processor is further configured to:receive, via the communication interface, at least one additionalmeasurement report comprising at least one additional indication of atleast one additional partial measurement of a second measurement type ofthe RS-P resource, the at least one additional partial measurement beingmeasured by the wireless node across at least one subset of symbols ofthe multiple symbols.

In some aspects, partial measurements of the first measurement type areperformed by the wireless node for multiple RS-Ps, and reporting of thepartial measurements is performed for less than all of the RS-Ps.

In some aspects, the reporting of the partial measurements is performedperiodically, aperiodically, or semi-periodically.

In some aspects, the measurement report is received in response to anon-demand request.

In some aspects, the on-demand request is configured to request a singlepartial measurement indication or multiple partial measurementindications.

In some aspects, the on-demand request specifies a number of the firstsubset of symbols, a starting symbol of the first subset of symbols, ora combination thereof.

In some aspects, the measurement report includes an indication of thefirst subset of symbols.

In some aspects, the first measurement type corresponds to a referencesignal time difference (RSTD) measurement or a receive-transmit (Rx-Tx)time difference.

In some aspects, the wireless node corresponds to a base station or auser equipment (UE).

In some aspects, the RS-P corresponds to a downlink positioningreference signal (DL-PRS), an uplink sounding reference signal forpositioning (UL-SRS-P) or a sidelink PRS (SL-PRS).

In an aspect, a wireless node includes means for performing a firstpartial measurement of a first measurement type of a reference signalfor positioning (RS-P) resource that includes multiple symbols, thefirst partial measurement being measured across a first subset of themultiple symbols; and means for transmitting a measurement report thatincludes an indication of the first partial measurement.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at an initial symbol of the RS-P resource.

In some aspects, the method includes means for performing a fullmeasurement of the first measurement type of the RS-P resource, the fullmeasurement being measured across all symbols of the RS-P resource.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the full measurement.

In some aspects, indications of the first partial measurement and thefull measurement are transmitted via separate measurement reports.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at a starting symbol that is later than aninitial symbol of the RS-P resource.

In some aspects, the method includes means for performing a secondpartial measurement of the first measurement type of the RS-P, thesecond partial measurement being measured across a second subset of themultiple symbols, the second subset of symbols being different than thefirst subset of symbols.

In some aspects, a number of the first subset of symbols is the same asa number of the second subset of symbols.

In some aspects, a number of the first subset of symbols is differentthan a number of the second subset of symbols.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the second partial measurement.

In some aspects, indications of the first partial measurement and thesecond partial measurement are transmitted via separate measurementreports.

In some aspects, the method includes means for determining whether aspoofing attack is associated with the RS-P based at least in part uponthe first partial measurement.

In some aspects, the method includes means for performing at least oneadditional partial measurement of a second measurement type of the RS-Presource, the at least one additional partial measurement being measuredacross at least one subset of symbols of the multiple symbols; and meansfor transmitting at least one additional measurement report thatincludes at least one additional indication of the at least oneadditional partial measurement.

In some aspects, partial measurements of the first measurement type areperformed for multiple RS-Ps, and reporting of the partial measurementsis performed for less than all of the RS-Ps.

In some aspects, the reporting of the partial measurements is performedperiodically, aperiodically, or semi-periodically.

In some aspects, the measurement report is transmitted in response to anon-demand request.

In some aspects, the on-demand request is configured to request a singlepartial measurement indication or multiple partial measurementindications.

In some aspects, the on-demand request specifies a number of the firstsubset of symbols, a starting symbol of the first subset of symbols, ora combination thereof.

In some aspects, the measurement report includes an indication of thefirst subset of symbols.

In some aspects, the first measurement type corresponds to a referencesignal time difference (RSTD) measurement or a receive-transmit (Rx-Tx)time difference.

In some aspects, the wireless node corresponds to a base station or auser equipment (UE).

In some aspects, the RS-P corresponds to a downlink positioningreference signal (DL-PRS), an uplink sounding reference signal forpositioning (UL-SRS-P) or a sidelink PRS (SL-PRS).

In an aspect, a communications device includes means for receiving, froma wireless node, a measurement report that includes an indication of afirst partial measurement of a first measurement type of a referencesignal for positioning (RS-P) resource that includes multiple symbols,the first partial measurement being measured by the wireless node acrossa first subset of the multiple symbols; and means for determiningwhether a spoofing attack is associated with the RS-P based at least inpart upon the measurement report.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at an initial symbol of the RS-P resource.

In some aspects, the measurement report or a separate measurement reportincludes a full measurement of the first measurement type of the RS-Presource, the full measurement being measured by the wireless nodeacross all symbols of the RS-P resource.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the full measurement.

In some aspects, indications of the first partial measurement and thefull measurement are received via the measurement report and theseparate measurement report, respectively.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at a starting symbol that is later than aninitial symbol of the RS-P resource.

In some aspects, the measurement report or a separate measurement reportincludes an indication of a second partial measurement of the firstmeasurement type of the RS-P, the second partial measurement beingmeasured across a second subset of the multiple symbols, the secondsubset of symbols being different than the first subset of symbols.

In some aspects, a number of the first subset of symbols is the same asa number of the second subset of symbols.

In some aspects, a number of the first subset of symbols is differentthan a number of the second subset of symbols.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the second partial measurement.

In some aspects, indications of the first partial measurement and thesecond partial measurement are received via the measurement report andthe separate measurement report, respectively.

In some aspects, the method includes means for receiving at least oneadditional measurement report comprising at least one additionalindication of at least one additional partial measurement of a secondmeasurement type of the RS-P resource, the at least one additionalpartial measurement being measured by the wireless node across at leastone subset of symbols of the multiple symbols.

In some aspects, partial measurements of the first measurement type areperformed by the wireless node for multiple RS-Ps, and reporting of thepartial measurements is performed for less than all of the RS-Ps.

In some aspects, the reporting of the partial measurements is performedperiodically, aperiodically, or semi-periodically.

In some aspects, the measurement report is received in response to anon-demand request.

In some aspects, the on-demand request is configured to request a singlepartial measurement indication or multiple partial measurementindications.

In some aspects, the on-demand request specifies a number of the firstsubset of symbols, a starting symbol of the first subset of symbols, ora combination thereof.

In some aspects, the measurement report includes an indication of thefirst subset of symbols.

In some aspects, the first measurement type corresponds to a referencesignal time difference (RSTD) measurement or a receive-transmit (Rx-Tx)time difference.

In some aspects, the wireless node corresponds to a base station or auser equipment (UE).

In some aspects, the RS-P corresponds to a downlink positioningreference signal (DL-PRS), an uplink sounding reference signal forpositioning (UL-SRS-P) or a sidelink PRS (SL-PRS).

In an aspect, a non-transitory computer-readable medium storingcomputer-executable instructions that, when executed by a wireless node,cause the wireless node to: perform a first partial measurement of afirst measurement type of a reference signal for positioning (RS-P)resource that includes multiple symbols, the first partial measurementbeing measured across a first subset of the multiple symbols; andtransmit a measurement report that includes an indication of the firstpartial measurement.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at an initial symbol of the RS-P resource.

In some aspects, the one or more instructions further cause the wirelessnode to: perform a full measurement of the first measurement type of theRS-P resource, the full measurement being measured across all symbols ofthe RS-P resource.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the full measurement.

In some aspects, indications of the first partial measurement and thefull measurement are transmitted via separate measurement reports.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at a starting symbol that is later than aninitial symbol of the RS-P resource.

In some aspects, the one or more instructions further cause the wirelessnode to: perform a second partial measurement of the first measurementtype of the RS-P, the second partial measurement being measured across asecond subset of the multiple symbols, the second subset of symbolsbeing different than the first subset of symbols.

In some aspects, a number of the first subset of symbols is the same asa number of the second subset of symbols.

In some aspects, a number of the first subset of symbols is differentthan a number of the second subset of symbols.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the second partial measurement.

In some aspects, indications of the first partial measurement and thesecond partial measurement are transmitted via separate measurementreports.

In some aspects, the one or more instructions further cause the wirelessnode to: determine whether a spoofing attack is associated with the RS-Pbased at least in part upon the first partial measurement.

In some aspects, the one or more instructions further cause the wirelessnode to: perform at least one additional partial measurement of a secondmeasurement type of the RS-P resource, the at least one additionalpartial measurement being measured across at least one subset of symbolsof the multiple symbols; and transmit at least one additionalmeasurement report that includes at least one additional indication ofthe at least one additional partial measurement.

In some aspects, partial measurements of the first measurement type areperformed for multiple RS-Ps, and reporting of the partial measurementsis performed for less than all of the RS-Ps.

In some aspects, the reporting of the partial measurements is performedperiodically, aperiodically, or semi-periodically.

In some aspects, the measurement report is transmitted in response to anon-demand request.

In some aspects, the on-demand request is configured to request a singlepartial measurement indication or multiple partial measurementindications.

In some aspects, the on-demand request specifies a number of the firstsubset of symbols, a starting symbol of the first subset of symbols, ora combination thereof.

In some aspects, the measurement report includes an indication of thefirst subset of symbols.

In some aspects, the first measurement type corresponds to a referencesignal time difference (RSTD) measurement or a receive-transmit (Rx-Tx)time difference.

In some aspects, the wireless node corresponds to a base station or auser equipment (UE).

In some aspects, the RS-P corresponds to a downlink positioningreference signal (DL-PRS), an uplink sounding reference signal forpositioning (UL-SRS-P) or a sidelink PRS (SL-PRS).

In an aspect, a non-transitory computer-readable medium storingcomputer-executable instructions that, when executed by a communicationsdevice, cause the communications device to: receive, from a wirelessnode, a measurement report that includes an indication of a firstpartial measurement of a first measurement type of a reference signalfor positioning (RS-P) resource that includes multiple symbols, thefirst partial measurement being measured by the wireless node across afirst subset of the multiple symbols; and determine whether a spoofingattack is associated with the RS-P based at least in part upon themeasurement report.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at an initial symbol of the RS-P resource.

In some aspects, the measurement report or a separate measurement reportincludes a full measurement of the first measurement type of the RS-Presource, the full measurement being measured by the wireless nodeacross all symbols of the RS-P resource.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the full measurement.

In some aspects, indications of the first partial measurement and thefull measurement are received via the measurement report and theseparate measurement report, respectively.

In some aspects, the first subset of symbols includes two or morecontiguous symbols that begin at a starting symbol that is later than aninitial symbol of the RS-P resource.

In some aspects, the measurement report or a separate measurement reportincludes an indication of a second partial measurement of the firstmeasurement type of the RS-P, the second partial measurement beingmeasured across a second subset of the multiple symbols, the secondsubset of symbols being different than the first subset of symbols.

In some aspects, a number of the first subset of symbols is the same asa number of the second subset of symbols.

In some aspects, a number of the first subset of symbols is differentthan a number of the second subset of symbols.

In some aspects, the measurement report includes indications of both thefirst partial measurement and the second partial measurement.

In some aspects, indications of the first partial measurement and thesecond partial measurement are received via the measurement report andthe separate measurement report, respectively.

In some aspects, the one or more instructions further cause thecommunications device to: receive at least one additional measurementreport comprising at least one additional indication of at least oneadditional partial measurement of a second measurement type of the RS-Presource, the at least one additional partial measurement being measuredby the wireless node across at least one subset of symbols of themultiple symbols.

In some aspects, partial measurements of the first measurement type areperformed by the wireless node for multiple RS-Ps, and reporting of thepartial measurements is performed for less than all of the RS-Ps.

In some aspects, the reporting of the partial measurements is performedperiodically, aperiodically, or semi-periodically.

In some aspects, the measurement report is received in response to anon-demand request.

In some aspects, the on-demand request is configured to request a singlepartial measurement indication or multiple partial measurementindications.

In some aspects, the on-demand request specifies a number of the firstsubset of symbols, a starting symbol of the first subset of symbols, ora combination thereof.

In some aspects, the measurement report includes an indication of thefirst subset of symbols.

In some aspects, the first measurement type corresponds to a referencesignal time difference (RSTD) measurement or a receive-transmit (Rx-Tx)time difference.

In some aspects, the wireless node corresponds to a base station or auser equipment (UE).

In some aspects, the RS-P corresponds to a downlink positioningreference signal (DL-PRS), an uplink sounding reference signal forpositioning (UL-SRS-P) or a sidelink PRS (SL-PRS).

Other objects and advantages associated with the aspects disclosedherein will be apparent to those skilled in the art based on theaccompanying drawings and detailed description.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings are presented to aid in the description ofvarious aspects of the disclosure and are provided solely forillustration of the aspects and not limitation thereof.

FIG. 1 illustrates an example wireless communications system, accordingto aspects of the disclosure.

FIGS. 2A and 2B illustrate example wireless network structures,according to aspects of the disclosure.

FIGS. 3A to 3C are simplified block diagrams of several sample aspectsof components that may be employed in a user equipment (UE), a basestation, and a network entity, respectively, and configured to supportcommunications as taught herein.

FIGS. 4A to 4D are diagrams illustrating example frame structures andchannels within the frame structures, according to aspects of thedisclosure.

FIG. 5 is a diagram of an example positioning reference signal (PRS)configuration for the PRS transmissions of a given base station,according to aspects of the disclosure.

FIG. 6 is a diagram of example positioning reference signal (PRS)resource sets having different time gaps, according to aspects of thedisclosure.

FIGS. 7A-7B illustrate various DL-PRS comb patterns, according toaspects of the disclosure.

FIG. 8 illustrates a PRS spoofing attack in accordance with an aspect ofthe disclosure.

FIG. 9 illustrates a PRS spoofing attack in accordance with anotheraspect of the disclosure.

FIG. 10A illustrates a PRS spoofing attack in accordance with anotheraspect of the disclosure.

FIG. 10B illustrates an example mitigation technique for countering thePRS spoofing attack of FIG. 10A in accordance with an aspect of thedisclosure.

FIG. 11 illustrates an exemplary process of wireless communication,according to aspects of the disclosure.

FIG. 12 illustrates an exemplary process of wireless communication,according to aspects of the disclosure.

FIG. 13 illustrates an example implementation of the processes of FIGS.11-12, respectively, in accordance with aspects of the disclosure.

FIG. 14 illustrates an example implementation of the processes of FIGS.11-12, respectively, in accordance with aspects of the disclosure.

DETAILED DESCRIPTION

Aspects of the disclosure are provided in the following description andrelated drawings directed to various examples provided for illustrationpurposes. Alternate aspects may be devised without departing from thescope of the disclosure. Additionally, well-known elements of thedisclosure will not be described in detail or will be omitted so as notto obscure the relevant details of the disclosure.

The words “exemplary” and/or “example” are used herein to mean “servingas an example, instance, or illustration.” Any aspect described hereinas “exemplary” and/or “example” is not necessarily to be construed aspreferred or advantageous over other aspects. Likewise, the term“aspects of the disclosure” does not require that all aspects of thedisclosure include the discussed feature, advantage or mode ofoperation.

Those of skill in the art will appreciate that the information andsignals described below may be represented using any of a variety ofdifferent technologies and techniques. For example, data, instructions,commands, information, signals, bits, symbols, and chips that may bereferenced throughout the description below may be represented byvoltages, currents, electromagnetic waves, magnetic fields or particles,optical fields or particles, or any combination thereof, depending inpart on the particular application, in part on the desired design, inpart on the corresponding technology, etc.

Further, many aspects are described in terms of sequences of actions tobe performed by, for example, elements of a computing device. It will berecognized that various actions described herein can be performed byspecific circuits (e.g., application specific integrated circuits(ASICs)), by program instructions being executed by one or moreprocessors, or by a combination of both. Additionally, the sequence(s)of actions described herein can be considered to be embodied entirelywithin any form of non-transitory computer-readable storage mediumhaving stored therein a corresponding set of computer instructions that,upon execution, would cause or instruct an associated processor of adevice to perform the functionality described herein. Thus, the variousaspects of the disclosure may be embodied in a number of differentforms, all of which have been contemplated to be within the scope of theclaimed subject matter. In addition, for each of the aspects describedherein, the corresponding form of any such aspects may be describedherein as, for example, “logic configured to” perform the describedaction.

As used herein, the terms “user equipment” (UE) and “base station” arenot intended to be specific or otherwise limited to any particular radioaccess technology (RAT), unless otherwise noted. In general, a UE may beany wireless communications device (e.g., a mobile phone, router, tabletcomputer, laptop computer, consumer asset locating device, wearable(e.g., smartwatch, glasses, augmented reality (AR) / virtual reality(VR) headset, etc.), vehicle (e.g., automobile, motorcycle, bicycle,etc.), Internet of Things (IoT) device, etc.) used by a user tocommunicate over a wireless communications network. A UE may be mobileor may (e.g., at certain times) be stationary, and may communicate witha radio access network (RAN). As used herein, the term “UE” may bereferred to interchangeably as an “access terminal” or “AT,” a “clientdevice,” a “wireless device,” a “subscriber device,” a “subscriberterminal,” a “subscriber station,” a “user terminal” or “UT,” a “mobiledevice,” a “mobile terminal,” a “mobile station,” or variations thereof.Generally, UEs can communicate with a core network via a RAN, andthrough the core network the UEs can be connected with external networkssuch as the Internet and with other UEs. Of course, other mechanisms ofconnecting to the core network and/or the Internet are also possible forthe UEs, such as over wired access networks, wireless local area network(WLAN) networks (e.g., based on the Institute of Electrical andElectronics Engineers (IEEE) 802.11 specification, etc.) and so on.

A base station may operate according to one of several RATs incommunication with UEs depending on the network in which it is deployed,and may be alternatively referred to as an access point (AP), a networknode, a NodeB, an evolved NodeB (eNB), a next generation eNB (ng-eNB), aNew Radio (NR) Node B (also referred to as a gNB or gNodeB), etc. A basestation may be used primarily to support wireless access by UEs,including supporting data, voice, and/or signaling connections for thesupported UEs. In some systems a base station may provide purely edgenode signaling functions while in other systems it may provideadditional control and/or network management functions. A communicationlink through which UEs can send signals to a base station is called anuplink (UL) channel (e.g., a reverse traffic channel, a reverse controlchannel, an access channel, etc.). A communication link through whichthe base station can send signals to UEs is called a downlink (DL) orforward link channel (e.g., a paging channel, a control channel, abroadcast channel, a forward traffic channel, etc.). As used herein theterm traffic channel (TCH) can refer to either an uplink/reverse ordownlink/forward traffic channel.

The term “base station” may refer to a single physicaltransmission-reception point (TRP) or to multiple physical TRPs that mayor may not be co-located. For example, where the term “base station”refers to a single physical TRP, the physical TRP may be an antenna ofthe base station corresponding to a cell (or several cell sectors) ofthe base station. Where the term “base station” refers to multipleco-located physical TRPs, the physical TRPs may be an array of antennas(e.g., as in a multiple-input multiple-output (MIMO) system or where thebase station employs beamforming) of the base station. Where the term“base station” refers to multiple non-co-located physical TRPs, thephysical TRPs may be a distributed antenna system (DAS) (a network ofspatially separated antennas connected to a common source via atransport medium) or a remote radio head (RRH) (a remote base stationconnected to a serving base station). Alternatively, the non-co-locatedphysical TRPs may be the serving base station receiving the measurementreport from the UE and a neighbor base station whose reference radiofrequency (RF) signals the UE is measuring. Because a TRP is the pointfrom which a base station transmits and receives wireless signals, asused herein, references to transmission from or reception at a basestation are to be understood as referring to a particular TRP of thebase station.

In some implementations that support positioning of UEs, a base stationmay not support wireless access by UEs (e.g., may not support data,voice, and/or signaling connections for UEs), but may instead transmitreference signals to UEs to be measured by the UEs, and/or may receiveand measure signals transmitted by the UEs. Such a base station may bereferred to as a positioning beacon (e.g., when transmitting signals toUEs) and/or as a location measurement unit (e.g., when receiving andmeasuring signals from UEs).

An “RF signal” comprises an electromagnetic wave of a given frequencythat transports information through the space between a transmitter anda receiver. As used herein, a transmitter may transmit a single “RFsignal” or multiple “RF signals” to a receiver. However, the receivermay receive multiple “RF signals” corresponding to each transmitted RFsignal due to the propagation characteristics of RF signals throughmultipath channels. The same transmitted RF signal on different pathsbetween the transmitter and receiver may be referred to as a “multipath”RF signal.

FIG. 1 illustrates an example wireless communications system 100,according to aspects of the disclosure. The wireless communicationssystem 100 (which may also be referred to as a wireless wide areanetwork (WWAN)) may include various base stations 102 (labeled “BS”) andvarious UEs 104. The base stations 102 may include macro cell basestations (high power cellular base stations) and/or small cell basestations (low power cellular base stations). In an aspect, the macrocell base station may include eNBs and/or ng-eNBs where the wirelesscommunications system 100 corresponds to an LTE network, or gNBs wherethe wireless communications system 100 corresponds to a NR network, or acombination of both, and the small cell base stations may includefemtocells, picocells, microcells, etc.

The base stations 102 may collectively form a RAN and interface with acore network 170 (e.g., an evolved packet core (EPC) or a 5G core (5GC))through backhaul links 122, and through the core network 170 to one ormore location servers 172 (e.g., a location management function (LMF) ora secure user plane location (SUPL) location platform (SLP)). Thelocation server(s) 172 may be part of core network 170 or may beexternal to core network 170. In addition to other functions, the basestations 102 may perform functions that relate to one or more oftransferring user data, radio channel ciphering and deciphering,integrity protection, header compression, mobility control functions(e.g., handover, dual connectivity), inter-cell interferencecoordination, connection setup and release, load balancing, distributionfor non-access stratum (NAS) messages, NAS node selection,synchronization, RAN sharing, multimedia broadcast multicast service(MBMS), subscriber and equipment trace, RAN information management(RIM), paging, positioning, and delivery of warning messages. The basestations 102 may communicate with each other directly or indirectly(e.g., through the EPC/5GC) over backhaul links 134, which may be wiredor wireless.

The base stations 102 may wirelessly communicate with the UEs 104. Eachof the base stations 102 may provide communication coverage for arespective geographic coverage area 110. In an aspect, one or more cellsmay be supported by a base station 102 in each geographic coverage area110. A “cell” is a logical communication entity used for communicationwith a base station (e.g., over some frequency resource, referred to asa carrier frequency, component carrier, carrier, band, or the like), andmay be associated with an identifier (e.g., a physical cell identifier(PCI), a virtual cell identifier (VCI), a cell global identifier (CGI))for distinguishing cells operating via the same or a different carrierfrequency. In some cases, different cells may be configured according todifferent protocol types (e.g., machine-type communication (MTC),narrowband IoT (NB-IoT), enhanced mobile broadband (eMBB), or others)that may provide access for different types of UEs. Because a cell issupported by a specific base station, the term “cell” may refer toeither or both of the logical communication entity and the base stationthat supports it, depending on the context. In some cases, the term“cell” may also refer to a geographic coverage area of a base station(e.g., a sector), insofar as a carrier frequency can be detected andused for communication within some portion of geographic coverage areas110.

While neighboring macro cell base station 102 geographic coverage areas110 may partially overlap (e.g., in a handover region), some of thegeographic coverage areas 110 may be substantially overlapped by alarger geographic coverage area 110. For example, a small cell (SC) basestation 102′ may have a geographic coverage area 110′ that substantiallyoverlaps with the geographic coverage area 110 of one or more macro cellbase stations 102. A network that includes both small cell and macrocell base stations may be known as a heterogeneous network. Aheterogeneous network may also include home eNBs (HeNBs), which mayprovide service to a restricted group known as a closed subscriber group(CSG).

The communication links 120 between the base stations 102 and the UEs104 may include uplink (also referred to as reverse link) transmissionsfrom a UE 104 to a base station 102 and/or downlink (also referred to asforward link) transmissions from a base station 102 to a UE 104. Thecommunication links 120 may use MIMO antenna technology, includingspatial multiplexing, beamforming, and/or transmit diversity. Thecommunication links 120 may be through one or more carrier frequencies.Allocation of carriers may be asymmetric with respect to downlink anduplink (e.g., more or less carriers may be allocated for downlink thanfor uplink).

The wireless communications system 100 may further include a wirelesslocal area network (WLAN) access point (AP) 150 in communication withWLAN stations (STAs) 152 via communication links 154 in an unlicensedfrequency spectrum (e.g., 5 GHz). When communicating in an unlicensedfrequency spectrum, the WLAN STAs 152 and/or the WLAN AP 150 may performa clear channel assessment (CCA) or listen before talk (LBT) procedureprior to communicating in order to determine whether the channel isavailable.

The small cell base station 102′ may operate in a licensed and/or anunlicensed frequency spectrum. When operating in an unlicensed frequencyspectrum, the small cell base station 102′ may employ LTE or NRtechnology and use the same 5 GHz unlicensed frequency spectrum as usedby the WLAN AP 150. The small cell base station 102′, employing LTE/5Gin an unlicensed frequency spectrum, may boost coverage to and/orincrease capacity of the access network. NR in unlicensed spectrum maybe referred to as NR-U. LTE in an unlicensed spectrum may be referred toas LTE-U, licensed assisted access (LAA), or MulteFire.

The wireless communications system 100 may further include a millimeterwave (mmW) base station 180 that may operate in mmW frequencies and/ornear mmW frequencies in communication with a UE 182. Extremely highfrequency (EHF) is part of the RF in the electromagnetic spectrum. EHFhas a range of 30 GHz to 300 GHz and a wavelength between 1 millimeterand 10 millimeters. Radio waves in this band may be referred to as amillimeter wave. Near mmW may extend down to a frequency of 3 GHz with awavelength of 100 millimeters. The super high frequency (SHF) bandextends between 3 GHz and 30 GHz, also referred to as centimeter wave.Communications using the mmW/near mmW radio frequency band have highpath loss and a relatively short range. The mmW base station 180 and theUE 182 may utilize beamforming (transmit and/or receive) over a mmWcommunication link 184 to compensate for the extremely high path lossand short range. Further, it will be appreciated that in alternativeconfigurations, one or more base stations 102 may also transmit usingmmW or near mmW and beamforming. Accordingly, it will be appreciatedthat the foregoing illustrations are merely examples and should not beconstrued to limit the various aspects disclosed herein.

Transmit beamforming is a technique for focusing an RF signal in aspecific direction. Traditionally, when a network node (e.g., a basestation) broadcasts an RF signal, it broadcasts the signal in alldirections (omni-directionally). With transmit beamforming, the networknode determines where a given target device (e.g., a UE) is located(relative to the transmitting network node) and projects a strongerdownlink RF signal in that specific direction, thereby providing afaster (in terms of data rate) and stronger RF signal for the receivingdevice(s). To change the directionality of the RF signal whentransmitting, a network node can control the phase and relativeamplitude of the RF signal at each of the one or more transmitters thatare broadcasting the RF signal. For example, a network node may use anarray of antennas (referred to as a “phased array” or an “antennaarray”) that creates a beam of RF waves that can be “steered” to pointin different directions, without actually moving the antennas.Specifically, the RF current from the transmitter is fed to theindividual antennas with the correct phase relationship so that theradio waves from the separate antennas add together to increase theradiation in a desired direction, while cancelling to suppress radiationin undesired directions.

Transmit beams may be quasi-co-located, meaning that they appear to thereceiver (e.g., a UE) as having the same parameters, regardless ofwhether or not the transmitting antennas of the network node themselvesare physically co-located. In NR, there are four types ofquasi-co-location (QCL) relations. Specifically, a QCL relation of agiven type means that certain parameters about a target reference RFsignal on a target beam can be derived from information about a sourcereference RF signal on a source beam. If the source reference RF signalis QCL Type A, the receiver can use the source reference RF signal toestimate the Doppler shift, Doppler spread, average delay, and delayspread of a target reference RF signal transmitted on the same channel.If the source reference RF signal is QCL Type B, the receiver can usethe source reference RF signal to estimate the Doppler shift and Dopplerspread of a target reference RF signal transmitted on the same channel.If the source reference RF signal is QCL Type C, the receiver can usethe source reference RF signal to estimate the Doppler shift and averagedelay of a target reference RF signal transmitted on the same channel.If the source reference RF signal is QCL Type D, the receiver can usethe source reference RF signal to estimate the spatial receive parameterof a target reference RF signal transmitted on the same channel.

In receive beamforming, the receiver uses a receive beam to amplify RFsignals detected on a given channel. For example, the receiver canincrease the gain setting and/or adjust the phase setting of an array ofantennas in a particular direction to amplify (e.g., to increase thegain level of) the RF signals received from that direction. Thus, when areceiver is said to beamform in a certain direction, it means the beamgain in that direction is high relative to the beam gain along otherdirections, or the beam gain in that direction is the highest comparedto the beam gain in that direction of all other receive beams availableto the receiver. This results in a stronger received signal strength(e.g., reference signal received power (RSRP), reference signal receivedquality (RSRQ), signal-to-interference-plus-noise ratio (SINR), etc.) ofthe RF signals received from that direction.

Receive beams may be spatially related. A spatial relation means thatparameters for a transmit beam for a second reference signal can bederived from information about a receive beam for a first referencesignal. For example, a UE may use a particular receive beam to receiveone or more reference downlink reference signals (e.g., positioningreference signals (PRS), tracking reference signals (TRS), phasetracking reference signal (PTRS), cell-specific reference signals (CRS),channel state information reference signals (CSI-RS), primarysynchronization signals (PSS), secondary synchronization signals (SSS),synchronization signal blocks (SSBs), etc.) from a base station. The UEcan then form a transmit beam for sending one or more uplink referencesignals (e.g., uplink positioning reference signals (UL-PRS), soundingreference signal (SRS), demodulation reference signals (DMRS), PTRS,etc.) to that base station based on the parameters of the receive beam.

Note that a “downlink” beam may be either a transmit beam or a receivebeam, depending on the entity forming it. For example, if a base stationis forming the downlink beam to transmit a reference signal to a UE, thedownlink beam is a transmit beam. If the UE is forming the downlinkbeam, however, it is a receive beam to receive the downlink referencesignal. Similarly, an “uplink” beam may be either a transmit beam or areceive beam, depending on the entity forming it. For example, if a basestation is forming the uplink beam, it is an uplink receive beam, and ifa UE is forming the uplink beam, it is an uplink transmit beam.

In 5G, the frequency spectrum in which wireless nodes (e.g., basestations 102/180, UEs 104/182) operate is divided into multiplefrequency ranges, FR1 (from 450 to 6000 MHz), FR2 (from 24250 to 52600MHz), FR3 (above 52600 MHz), and FR4 (between FR1 and FR2). In amulti-carrier system, such as 5G, one of the carrier frequencies isreferred to as the “primary carrier” or “anchor carrier” or “primaryserving cell” or “PCell,” and the remaining carrier frequencies arereferred to as “secondary carriers” or “secondary serving cells” or“SCells.” In carrier aggregation, the anchor carrier is the carrieroperating on the primary frequency (e.g., FR1) utilized by a UE 104/182and the cell in which the UE 104/182 either performs the initial radioresource control (RRC) connection establishment procedure or initiatesthe RRC connection re-establishment procedure. The primary carriercarries all common and UE-specific control channels, and may be acarrier in a licensed frequency (however, this is not always the case).A secondary carrier is a carrier operating on a second frequency (e.g.,FR2) that may be configured once the RRC connection is establishedbetween the UE 104 and the anchor carrier and that may be used toprovide additional radio resources. In some cases, the secondary carriermay be a carrier in an unlicensed frequency. The secondary carrier maycontain only necessary signaling information and signals, for example,those that are UE-specific may not be present in the secondary carrier,since both primary uplink and downlink carriers are typicallyUE-specific. This means that different UEs 104/182 in a cell may havedifferent downlink primary carriers. The same is true for the uplinkprimary carriers. The network is able to change the primary carrier ofany UE 104/182 at any time. This is done, for example, to balance theload on different carriers. Because a “serving cell” (whether a PCell oran SCell) corresponds to a carrier frequency/component carrier overwhich some base station is communicating, the term “cell,” “servingcell,” “component carrier,” “carrier frequency,” and the like can beused interchangeably.

For example, still referring to FIG. 1, one of the frequencies utilizedby the macro cell base stations 102 may be an anchor carrier (or“PCell”) and other frequencies utilized by the macro cell base stations102 and/or the mmW base station 180 may be secondary carriers(“SCells”). The simultaneous transmission and/or reception of multiplecarriers enables the UE 104/182 to significantly increase its datatransmission and/or reception rates. For example, two 20 MHz aggregatedcarriers in a multi-carrier system would theoretically lead to atwo-fold increase in data rate (i.e., 40 MHz), compared to that attainedby a single 20 MHz carrier.

The wireless communications system 100 may further include a UE 164 thatmay communicate with a macro cell base station 102 over a communicationlink 120 and/or the mmW base station 180 over a mmW communication link184. For example, the macro cell base station 102 may support a PCelland one or more SCells for the UE 164 and the mmW base station 180 maysupport one or more SCells for the UE 164.

In the example of FIG. 1, one or more Earth orbiting satellitepositioning system (SPS) space vehicles (SVs) 112 (e.g., satellites) maybe used as an independent source of location information for any of theillustrated UEs (shown in FIG. 1 as a single UE 104 for simplicity). AUE 104 may include one or more dedicated SPS receivers specificallydesigned to receive SPS signals 124 for deriving geo locationinformation from the SVs 112. An SPS typically includes a system oftransmitters (e.g., SVs 112) positioned to enable receivers (e.g., UEs104) to determine their location on or above the Earth based, at leastin part, on signals (e.g., SPS signals 124) received from thetransmitters. Such a transmitter typically transmits a signal markedwith a repeating pseudo-random noise (PN) code of a set number of chips.While typically located in SVs 112, transmitters may sometimes belocated on ground-based control stations, base stations 102, and/orother UEs 104.

The use of SPS signals 124 can be augmented by various satellite-basedaugmentation systems (SBAS) that may be associated with or otherwiseenabled for use with one or more global and/or regional navigationsatellite systems. For example an SBAS may include an augmentationsystem(s) that provides integrity information, differential corrections,etc., such as the Wide Area Augmentation System (WAAS), the EuropeanGeostationary Navigation Overlay Service (EGNOS), the Multi-functionalSatellite Augmentation System (MSAS), the Global Positioning System(GPS) Aided Geo Augmented Navigation or GPS and Geo Augmented Navigationsystem (GAGAN), and/or the like. Thus, as used herein, an SPS mayinclude any combination of one or more global and/or regional navigationsatellite systems and/or augmentation systems, and SPS signals 124 mayinclude SPS, SPS-like, and/or other signals associated with such one ormore SPS.

The wireless communications system 100 may further include one or moreUEs, such as UE 190, that connects indirectly to one or morecommunication networks via one or more device-to-device (D2D)peer-to-peer (P2P) links (referred to as “sidelinks”). In the example ofFIG. 1, UE 190 has a D2D P2P link 192 with one of the UEs 104 connectedto one of the base stations 102 (e.g., through which UE 190 mayindirectly obtain cellular connectivity) and a D2D P2P link 194 withWLAN STA 152 connected to the WLAN AP 150 (through which UE 190 mayindirectly obtain WLAN-based Internet connectivity). In an example, theD2D P2P links 192 and 194 may be supported with any well-known D2D RAT,such as LTE Direct (LTE-D), WiFi Direct (WiFi-D), Bluetooth®, and so on.

FIG. 2A illustrates an example wireless network structure 200. Forexample, a 5GC 210 (also referred to as a Next Generation Core (NGC))can be viewed functionally as control plane functions 214 (e.g., UEregistration, authentication, network access, gateway selection, etc.)and user plane functions 212, (e.g., UE gateway function, access to datanetworks, IP routing, etc.) which operate cooperatively to form the corenetwork. User plane interface (NG-U) 213 and control plane interface(NG-C) 215 connect the gNB 222 to the 5GC 210 and specifically to thecontrol plane functions 214 and user plane functions 212. In anadditional configuration, an ng-eNB 224 may also be connected to the 5GC210 via NG-C 215 to the control plane functions 214 and NG-U 213 to userplane functions 212. Further, ng-eNB 224 may directly communicate withgNB 222 via a backhaul connection 223. In some configurations, a NextGeneration RAN (NG-RAN) 220 may only have one or more gNBs 222, whileother configurations include one or more of both ng-eNBs 224 and gNBs222. Either gNB 222 or ng-eNB 224 may communicate with UEs 204 (e.g.,any of the UEs depicted in FIG. 1). Another optional aspect may includelocation server 230, which may be in communication with the 5GC 210 toprovide location assistance for UEs 204. The location server 230 can beimplemented as a plurality of separate servers (e.g., physicallyseparate servers, different software modules on a single server,different software modules spread across multiple physical servers,etc.), or alternately may each correspond to a single server. Thelocation server 230 can be configured to support one or more locationservices for UEs 204 that can connect to the location server 230 via thecore network, 5GC 210, and/or via the Internet (not illustrated).Further, the location server 230 may be integrated into a component ofthe core network, or alternatively may be external to the core network.

FIG. 2B illustrates another example wireless network structure 250. A5GC 260 (which may correspond to 5GC 210 in FIG. 2A) can be viewedfunctionally as control plane functions, provided by an access andmobility management function (AMF) 264, and user plane functions,provided by a user plane function (UPF) 262, which operate cooperativelyto form the core network (i.e., 5GC 260). User plane interface 263 andcontrol plane interface 265 connect the ng-eNB 224 to the 5GC 260 andspecifically to UPF 262 and AMF 264, respectively. In an additionalconfiguration, a gNB 222 may also be connected to the 5GC 260 viacontrol plane interface 265 to AMF 264 and user plane interface 263 toUPF 262. Further, ng-eNB 224 may directly communicate with gNB 222 viathe backhaul connection 223, with or without gNB direct connectivity tothe 5GC 260. In some configurations, the NG-RAN 220 may only have one ormore gNBs 222, while other configurations include one or more of bothng-eNBs 224 and gNBs 222. Either gNB 222 or ng-eNB 224 may communicatewith UEs 204 (e.g., any of the UEs depicted in FIG. 1). The basestations of the NG-RAN 220 communicate with the AMF 264 over the N2interface and with the UPF 262 over the N3 interface.

The functions of the AMF 264 include registration management, connectionmanagement, reachability management, mobility management, lawfulinterception, transport for session management (SM) messages between theUE 204 and a session management function (SMF) 266, transparent proxyservices for routing SM messages, access authentication and accessauthorization, transport for short message service (SMS) messagesbetween the UE 204 and the short message service function (SMSF) (notshown), and security anchor functionality (SEAF). The AMF 264 alsointeracts with an authentication server function (AUSF) (not shown) andthe UE 204, and receives the intermediate key that was established as aresult of the UE 204 authentication process. In the case ofauthentication based on a UMTS (universal mobile telecommunicationssystem) subscriber identity module (USIM), the AMF 264 retrieves thesecurity material from the AUSF. The functions of the AMF 264 alsoinclude security context management (SCM). The SCM receives a key fromthe SEAF that it uses to derive access-network specific keys. Thefunctionality of the AMF 264 also includes location services managementfor regulatory services, transport for location services messagesbetween the UE 204 and an LMF 270 (which acts as a location server 230),transport for location services messages between the NG-RAN 220 and theLMF 270, evolved packet system (EPS) bearer identifier allocation forinterworking with the EPS, and UE 204 mobility event notification. Inaddition, the AMF 264 also supports functionalities for non-3GPP (ThirdGeneration Partnership Project) access networks.

Functions of the UPF 262 include acting as an anchor point forintra-/inter-RAT mobility (when applicable), acting as an externalprotocol data unit (PDU) session point of interconnect to a data network(not shown), providing packet routing and forwarding, packet inspection,user plane policy rule enforcement (e.g., gating, redirection, trafficsteering), lawful interception (user plane collection), traffic usagereporting, quality of service (QoS) handling for the user plane (e.g.,uplink/ downlink rate enforcement, reflective QoS marking in thedownlink), uplink traffic verification (service data flow (SDF) to QoSflow mapping), transport level packet marking in the uplink anddownlink, downlink packet buffering and downlink data notificationtriggering, and sending and forwarding of one or more “end markers” tothe source RAN node. The UPF 262 may also support transfer of locationservices messages over a user plane between the UE 204 and a locationserver, such as an SLP 272.

The functions of the SMF 266 include session management, UE Internetprotocol (IP) address allocation and management, selection and controlof user plane functions, configuration of traffic steering at the UPF262 to route traffic to the proper destination, control of part ofpolicy enforcement and QoS, and downlink data notification. Theinterface over which the SMF 266 communicates with the AMF 264 isreferred to as the N11 interface.

Another optional aspect may include an LMF 270, which may be incommunication with the 5GC 260 to provide location assistance for UEs204. The LMF 270 can be implemented as a plurality of separate servers(e.g., physically separate servers, different software modules on asingle server, different software modules spread across multiplephysical servers, etc.), or alternately may each correspond to a singleserver. The LMF 270 can be configured to support one or more locationservices for UEs 204 that can connect to the LMF 270 via the corenetwork, 5GC 260, and/or via the Internet (not illustrated). The SLP 272may support similar functions to the LMF 270, but whereas the LMF 270may communicate with the AMF 264, NG-RAN 220, and UEs 204 over a controlplane (e.g., using interfaces and protocols intended to convey signalingmessages and not voice or data), the SLP 272 may communicate with UEs204 and external clients (not shown in FIG. 2B) over a user plane (e.g.,using protocols intended to carry voice and/or data like thetransmission control protocol (TCP) and/or IP).

FIGS. 3A, 3B, and 3C illustrate several example components (representedby corresponding blocks) that may be incorporated into a UE 302 (whichmay correspond to any of the UEs described herein), a base station 304(which may correspond to any of the base stations described herein), anda network entity 306 (which may correspond to or embody any of thenetwork functions described herein, including the location server 230and the LMF 270) to support the file transmission operations as taughtherein. It will be appreciated that these components may be implementedin different types of apparatuses in different implementations (e.g., inan ASIC, in a system-on-chip (SoC), etc.). The illustrated componentsmay also be incorporated into other apparatuses in a communicationsystem. For example, other apparatuses in a system may includecomponents similar to those described to provide similar functionality.Also, a given apparatus may contain one or more of the components. Forexample, an apparatus may include multiple transceiver components thatenable the apparatus to operate on multiple carriers and/or communicatevia different technologies.

The UE 302 and the base station 304 each include wireless wide areanetwork (WWAN) transceiver 310 and 350, respectively, providing meansfor communicating (e.g., means for transmitting, means for receiving,means for measuring, means for tuning, means for refraining fromtransmitting, etc.) via one or more wireless communication networks (notshown), such as an NR network, an LTE network, a GSM network, and/or thelike. The WWAN transceivers 310 and 350 may be connected to one or moreantennas 316 and 356, respectively, for communicating with other networknodes, such as other UEs, access points, base stations (e.g., eNBs,gNBs), etc., via at least one designated RAT (e.g., NR, LTE, GSM, etc.)over a wireless communication medium of interest (e.g., some set oftime/frequency resources in a particular frequency spectrum). The WWANtransceivers 310 and 350 may be variously configured for transmittingand encoding signals 318 and 358 (e.g., messages, indications,information, and so on), respectively, and, conversely, for receivingand decoding signals 318 and 358 (e.g., messages, indications,information, pilots, and so on), respectively, in accordance with thedesignated RAT. Specifically, the WWAN transceivers 310 and 350 includeone or more transmitters 314 and 354, respectively, for transmitting andencoding signals 318 and 358, respectively, and one or more receivers312 and 352, respectively, for receiving and decoding signals 318 and358, respectively.

The UE 302 and the base station 304 also include, at least in somecases, one or more short-range wireless transceivers 320 and 360,respectively. The short-range wireless transceivers 320 and 360 may beconnected to one or more antennas 326 and 366, respectively, and providemeans for communicating (e.g., means for transmitting, means forreceiving, means for measuring, means for tuning, means for refrainingfrom transmitting, etc.) with other network nodes, such as other UEs,access points, base stations, etc., via at least one designated RAT(e.g., WiFi, LTE-D, Bluetooth®, Zigbee®, Z-Wave®, PC5, dedicatedshort-range communications (DSRC), wireless access for vehicularenvironments (WAVE), near-field communication (NFC), etc.) over awireless communication medium of interest. The short-range wirelesstransceivers 320 and 360 may be variously configured for transmittingand encoding signals 328 and 368 (e.g., messages, indications,information, and so on), respectively, and, conversely, for receivingand decoding signals 328 and 368 (e.g., messages, indications,information, pilots, and so on), respectively, in accordance with thedesignated RAT. Specifically, the short-range wireless transceivers 320and 360 include one or more transmitters 324 and 364, respectively, fortransmitting and encoding signals 328 and 368, respectively, and one ormore receivers 322 and 362, respectively, for receiving and decodingsignals 328 and 368, respectively. As specific examples, the short-rangewireless transceivers 320 and 360 may be WiFi transceivers, Bluetooth®transceivers, Zigbee® and/or Z-Wave® transceivers, NFC transceivers, orvehicle-to-vehicle (V2V) and/or vehicle-to-everything (V2X)transceivers.

Transceiver circuitry including at least one transmitter and at leastone receiver may comprise an integrated device (e.g., embodied as atransmitter circuit and a receiver circuit of a single communicationsdevice) in some implementations, may comprise a separate transmitterdevice and a separate receiver device in some implementations, or may beembodied in other ways in other implementations. In an aspect, atransmitter may include or be coupled to a plurality of antennas (e.g.,antennas 316, 326, 356, 366), such as an antenna array, that permits therespective apparatus to perform transmit “beamforming,” as describedherein. Similarly, a receiver may include or be coupled to a pluralityof antennas (e.g., antennas 316, 326, 356, 366), such as an antennaarray, that permits the respective apparatus to perform receivebeamforming, as described herein. In an aspect, the transmitter andreceiver may share the same plurality of antennas (e.g., antennas 316,326, 356, 366), such that the respective apparatus can only receive ortransmit at a given time, not both at the same time. A wirelesscommunications device (e.g., one or both of the transceivers 310 and 320and/or 350 and 360) of the UE 302 and/or the base station 304 may alsocomprise a network listen module (NLM) or the like for performingvarious measurements.

The UE 302 and the base station 304 also include, at least in somecases, satellite positioning systems (SPS) receivers 330 and 370. TheSPS receivers 330 and 370 may be connected to one or more antennas 336and 376, respectively, and may provide means for receiving and/ormeasuring SPS signals 338 and 378, respectively, such as globalpositioning system (GPS) signals, global navigation satellite system(GLONASS) signals, Galileo signals, Beidou signals, Indian RegionalNavigation Satellite System (NAVIC), Quasi-Zenith Satellite System(QZSS), etc. The SPS receivers 330 and 370 may comprise any suitablehardware and/or software for receiving and processing SPS signals 338and 378, respectively. The SPS receivers 330 and 370 request informationand operations as appropriate from the other systems, and performscalculations necessary to determine positions of the UE 302 and the basestation 304 using measurements obtained by any suitable SPS algorithm.

The base station 304 and the network entity 306 each include at leastone network interfaces 380 and 390, respectively, providing means forcommunicating (e.g., means for transmitting, means for receiving, etc.)with other network entities. For example, the network interfaces 380 and390 (e.g., one or more network access ports) may be configured tocommunicate with one or more network entities via a wire-based orwireless backhaul connection. In some aspects, the network interfaces380 and 390 may be implemented as transceivers configured to supportwire-based or wireless signal communication. This communication mayinvolve, for example, sending and receiving messages, parameters, and/orother types of information.

The UE 302, the base station 304, and the network entity 306 alsoinclude other components that may be used in conjunction with theoperations as disclosed herein. The UE 302 includes processor circuitryimplementing a processing system 332 for providing functionalityrelating to, for example, wireless positioning, and for providing otherprocessing functionality. The base station 304 includes a processingsystem 384 for providing functionality relating to, for example,wireless positioning as disclosed herein, and for providing otherprocessing functionality. The network entity 306 includes a processingsystem 394 for providing functionality relating to, for example,wireless positioning as disclosed herein, and for providing otherprocessing functionality. The processing systems 332, 384, and 394 maytherefore provide means for processing, such as means for determining,means for calculating, means for receiving, means for transmitting,means for indicating, etc. In an aspect, the processing systems 332,384, and 394 may include, for example, one or more processors, such asone or more general purpose processors, multi-core processors, ASICs,digital signal processors (DSPs), field programmable gate arrays (FPGA),other programmable logic devices or processing circuitry, or variouscombinations thereof.

The UE 302, the base station 304, and the network entity 306 includememory circuitry implementing memory components 340, 386, and 396 (e.g.,each including a memory device), respectively, for maintaininginformation (e.g., information indicative of reserved resources,thresholds, parameters, and so on). The memory components 340, 386, and396 may therefore provide means for storing, means for retrieving, meansfor maintaining, etc. In some cases, the UE 302, the base station 304,and the network entity 306 may include Spoofing Attack Modules 342, 388,and 398, respectively. The Spoofing Attack Modules 342, 388, and 398 maybe hardware circuits that are part of or coupled to the processingsystems 332, 384, and 394, respectively, that, when executed, cause theUE 302, the base station 304, and the network entity 306 to perform thefunctionality described herein. In other aspects, the Spoofing AttackModules 342, 388, and 398 may be external to the processing systems 332,384, and 394 (e.g., part of a modem processing system, integrated withanother processing system, etc.). Alternatively, the Spoofing AttackModules 342, 388, and 398 may be memory modules stored in the memorycomponents 340, 386, and 396, respectively, that, when executed by theprocessing systems 332, 384, and 394 (or a modem processing system,another processing system, etc.), cause the UE 302, the base station304, and the network entity 306 to perform the functionality describedherein. FIG. 3A illustrates possible locations of the Spoofing AttackModule 342, which may be part of the WWAN transceiver 310, the memorycomponent 340, the processing system 332, or any combination thereof, ormay be a standalone component. FIG. 3B illustrates possible locations ofthe Spoofing Attack Module 388, which may be part of the WWANtransceiver 350, the memory component 386, the processing system 384, orany combination thereof, or may be a standalone component. FIG. 3Cillustrates possible locations of the Spoofing Attack Module 398, whichmay be part of the network interface(s) 390, the memory component 396,the processing system 394, or any combination thereof, or may be astandalone component.

The UE 302 may include one or more sensors 344 coupled to the processingsystem 332 to provide means for sensing or detecting movement and/ororientation information that is independent of motion data derived fromsignals received by the WWAN transceiver 310, the short-range wirelesstransceiver 320, and/or the SPS receiver 330. By way of example, thesensor(s) 344 may include an accelerometer (e.g., a micro-electricalmechanical systems (MEMS) device), a gyroscope, a geomagnetic sensor(e.g., a compass), an altimeter (e.g., a barometric pressure altimeter),and/or any other type of movement detection sensor. Moreover, thesensor(s) 344 may include a plurality of different types of devices andcombine their outputs in order to provide motion information. Forexample, the sensor(s) 344 may use a combination of a multi-axisaccelerometer and orientation sensors to provide the ability to computepositions in 2D and/or 3D coordinate systems.

In addition, the UE 302 includes a user interface 346 providing meansfor providing indications (e.g., audible and/or visual indications) to auser and/or for receiving user input (e.g., upon user actuation of asensing device such a keypad, a touch screen, a microphone, and so on).Although not shown, the base station 304 and the network entity 306 mayalso include user interfaces.

Referring to the processing system 384 in more detail, in the downlink,IP packets from the network entity 306 may be provided to the processingsystem 384. The processing system 384 may implement functionality for anRRC layer, a packet data convergence protocol (PDCP) layer, a radio linkcontrol (RLC) layer, and a medium access control (MAC) layer. Theprocessing system 384 may provide RRC layer functionality associatedwith broadcasting of system information (e.g., master information block(MIB), system information blocks (SIBs)), RRC connection control (e.g.,RRC connection paging, RRC connection establishment, RRC connectionmodification, and RRC connection release), inter-RAT mobility, andmeasurement configuration for UE measurement reporting; PDCP layerfunctionality associated with header compression/decompression, security(ciphering, deciphering, integrity protection, integrity verification),and handover support functions; RLC layer functionality associated withthe transfer of upper layer PDUs, error correction through automaticrepeat request (ARQ), concatenation, segmentation, and reassembly of RLCservice data units (SDUs), re-segmentation of RLC data PDUs, andreordering of RLC data PDUs; and MAC layer functionality associated withmapping between logical channels and transport channels, schedulinginformation reporting, error correction, priority handling, and logicalchannel prioritization.

The transmitter 354 and the receiver 352 may implement Layer-1 (L1)functionality associated with various signal processing functions.Layer-1, which includes a physical (PHY) layer, may include errordetection on the transport channels, forward error correction (FEC)coding/decoding of the transport channels, interleaving, rate matching,mapping onto physical channels, modulation/demodulation of physicalchannels, and MIMO antenna processing. The transmitter 354 handlesmapping to signal constellations based on various modulation schemes(e.g., binary phase-shift keying (BPSK), quadrature phase-shift keying(QPSK), M-phase-shift keying (M-PSK), M-quadrature amplitude modulation(M-QAM)). The coded and modulated symbols may then be split intoparallel streams. Each stream may then be mapped to an orthogonalfrequency division multiplexing (OFDM) subcarrier, multiplexed with areference signal (e.g., pilot) in the time and/or frequency domain, andthen combined together using an inverse fast Fourier transform (IFFT) toproduce a physical channel carrying a time domain OFDM symbol stream.The OFDM symbol stream is spatially precoded to produce multiple spatialstreams. Channel estimates from a channel estimator may be used todetermine the coding and modulation scheme, as well as for spatialprocessing. The channel estimate may be derived from a reference signaland/or channel condition feedback transmitted by the UE 302. Eachspatial stream may then be provided to one or more different antennas356. The transmitter 354 may modulate an RF carrier with a respectivespatial stream for transmission.

At the UE 302, the receiver 312 receives a signal through its respectiveantenna(s) 316.

The receiver 312 recovers information modulated onto an RF carrier andprovides the information to the processing system 332. The transmitter314 and the receiver 312 implement Layer-1 functionality associated withvarious signal processing functions. The receiver 312 may performspatial processing on the information to recover any spatial streamsdestined for the UE 302. If multiple spatial streams are destined forthe UE 302, they may be combined by the receiver 312 into a single OFDMsymbol stream. The receiver 312 then converts the OFDM symbol streamfrom the time-domain to the frequency domain using a fast Fouriertransform (FFT). The frequency domain signal comprises a separate OFDMsymbol stream for each subcarrier of the OFDM signal. The symbols oneach subcarrier, and the reference signal, are recovered and demodulatedby determining the most likely signal constellation points transmittedby the base station 304. These soft decisions may be based on channelestimates computed by a channel estimator. The soft decisions are thendecoded and de-interleaved to recover the data and control signals thatwere originally transmitted by the base station 304 on the physicalchannel. The data and control signals are then provided to theprocessing system 332, which implements Layer-3 (L3) and Layer-2 (L2)functionality.

In the uplink, the processing system 332 provides demultiplexing betweentransport and logical channels, packet reassembly, deciphering, headerdecompression, and control signal processing to recover IP packets fromthe core network. The processing system 332 is also responsible forerror detection.

Similar to the functionality described in connection with the downlinktransmission by the base station 304, the processing system 332 providesRRC layer functionality associated with system information (e.g., MIB,SIBs) acquisition, RRC connections, and measurement reporting; PDCPlayer functionality associated with header compression/decompression,and security (ciphering, deciphering, integrity protection, integrityverification); RLC layer functionality associated with the transfer ofupper layer PDUs, error correction through ARQ, concatenation,segmentation, and reassembly of RLC SDUs, re-segmentation of RLC dataPDUs, and reordering of RLC data PDUs; and MAC layer functionalityassociated with mapping between logical channels and transport channels,multiplexing of MAC SDUs onto transport blocks (TBs), demultiplexing ofMAC SDUs from TBs, scheduling information reporting, error correctionthrough hybrid automatic repeat request (HARD), priority handling, andlogical channel prioritization.

Channel estimates derived by the channel estimator from a referencesignal or feedback transmitted by the base station 304 may be used bythe transmitter 314 to select the appropriate coding and modulationschemes, and to facilitate spatial processing. The spatial streamsgenerated by the transmitter 314 may be provided to different antenna(s)316. The transmitter 314 may modulate an RF carrier with a respectivespatial stream for transmission.

The uplink transmission is processed at the base station 304 in a mannersimilar to that described in connection with the receiver function atthe UE 302. The receiver 352 receives a signal through its respectiveantenna(s) 356. The receiver 352 recovers information modulated onto anRF carrier and provides the information to the processing system 384.

In the uplink, the processing system 384 provides demultiplexing betweentransport and logical channels, packet reassembly, deciphering, headerdecompression, control signal processing to recover IP packets from theUE 302. IP packets from the processing system 384 may be provided to thecore network. The processing system 384 is also responsible for errordetection.

For convenience, the UE 302, the base station 304, and/or the networkentity 306 are shown in FIGS. 3A to 3C as including various componentsthat may be configured according to the various examples describedherein. It will be appreciated, however, that the illustrated blocks mayhave different functionality in different designs.

The various components of the UE 302, the base station 304, and thenetwork entity 306 may communicate with each other over data buses 334,382, and 392, respectively. The components of FIGS. 3A to 3C may beimplemented in various ways. In some implementations, the components ofFIGS. 3A to 3C may be implemented in one or more circuits such as, forexample, one or more processors and/or one or more ASICs (which mayinclude one or more processors). Here, each circuit may use and/orincorporate at least one memory component for storing information orexecutable code used by the circuit to provide this functionality. Forexample, some or all of the functionality represented by blocks 310 to346 may be implemented by processor and memory component(s) of the UE302 (e.g., by execution of appropriate code and/or by appropriateconfiguration of processor components). Similarly, some or all of thefunctionality represented by blocks 350 to 388 may be implemented byprocessor and memory component(s) of the base station 304 (e.g., byexecution of appropriate code and/or by appropriate configuration ofprocessor components). Also, some or all of the functionalityrepresented by blocks 390 to 398 may be implemented by processor andmemory component(s) of the network entity 306 (e.g., by execution ofappropriate code and/or by appropriate configuration of processorcomponents). For simplicity, various operations, acts, and/or functionsare described herein as being performed “by a UE,” “by a base station,”“by a network entity,” etc. However, as will be appreciated, suchoperations, acts, and/or functions may actually be performed by specificcomponents or combinations of components of the UE 302, base station304, network entity 306, etc., such as the processing systems 332, 384,394, the transceivers 310, 320, 350, and 360 the memory components 340,386, and 396, the Spoofing Attack Modules 342, 388, and 398, etc.

Various frame structures may be used to support downlink and uplinktransmissions between network nodes (e.g., base stations and UEs). FIG.4A is a diagram 400 illustrating an example of a downlink framestructure, according to aspects of the disclosure. FIG. 4B is a diagram430 illustrating an example of channels within the downlink framestructure, according to aspects of the disclosure. FIG. 4C is a diagram450 illustrating an example of an uplink frame structure, according toaspects of the disclosure. FIG. 4D is a diagram 480 illustrating anexample of channels within an uplink frame structure, according toaspects of the disclosure. Other wireless communications technologiesmay have different frame structures and/or different channels.

LTE, and in some cases NR, utilizes OFDM on the downlink andsingle-carrier frequency division multiplexing (SC-FDM) on the uplink.Unlike LTE, however, NR has an option to use OFDM on the uplink as well.OFDM and SC-FDM partition the system bandwidth into multiple (K)orthogonal subcarriers, which are also commonly referred to as tones,bins, etc. Each subcarrier may be modulated with data. In general,modulation symbols are sent in the frequency domain with OFDM and in thetime domain with SC-FDM. The spacing between adjacent subcarriers may befixed, and the total number of subcarriers (K) may be dependent on thesystem bandwidth. For example, the spacing of the subcarriers may be 15kilohertz (kHz) and the minimum resource allocation (resource block) maybe 12 subcarriers (or 180 kHz). Consequently, the nominal FFT size maybe equal to 128, 256, 512, 1024, or 2048 for system bandwidth of 1.25,2.5, 5, 10, or 20 megahertz (MHz), respectively. The system bandwidthmay also be partitioned into subbands. For example, a subband may cover1.08 MHz (i.e., 6 resource blocks), and there may be 1, 2, 4, 8, or 16subbands for system bandwidth of 1.25, 2.5, 5, 10, or 20 MHz,respectively.

LTE supports a single numerology (subcarrier spacing (SCS), symbollength, etc.). In contrast, NR may support multiple numerologies (μ),for example, subcarrier spacings of 15 kHz (μ=0), 30 kHz (μ=1), 60 kHz(μ=2), 120 kHz (μ=3), and 240 kHz (μ=4) or greater may be available. Ineach subcarrier spacing, there are 14 symbols per slot. For 15 kHz SCS(μ=0), there is one slot per subframe, 10 slots per frame, the slotduration is 1 millisecond (ms), the symbol duration is 66.7 microseconds(μs), and the maximum nominal system bandwidth (in MHz) with a 4K FFTsize is 50. For 30 kHz SCS (μ=1), there are two slots per subframe, 20slots per frame, the slot duration is 0.5 ms, the symbol duration is33.3 μs, and the maximum nominal system bandwidth (in MHz) with a 4K FFTsize is 100. For 60 kHz SCS (v2), there are four slots per subframe, 40slots per frame, the slot duration is 0.25 ms, the symbol duration is16.7 μs, and the maximum nominal system bandwidth (in MHz) with a 4K FFTsize is 200. For 120 kHz SCS (μ=3), there are eight slots per subframe,80 slots per frame, the slot duration is 0.125 ms, the symbol durationis 8.33 μs, and the maximum nominal system bandwidth (in MHz) with a 4KFFT size is 400. For 240 kHz SCS (μ=4), there are 16 slots per subframe,160 slots per frame, the slot duration is 0.0625 ms, the symbol durationis 4.17 μs, and the maximum nominal system bandwidth (in MHz) with a 4KFFT size is 800.

In the example of FIGS. 4A to 4D, a numerology of 15 kHz is used. Thus,in the time domain, a 10 ms frame is divided into 10 equally sizedsubframes of 1 ms each, and each subframe includes one time slot. InFIGS. 4A to 4D, time is represented horizontally (on the X axis) withtime increasing from left to right, while frequency is representedvertically (on the Y axis) with frequency increasing (or decreasing)from bottom to top.

A resource grid may be used to represent time slots, each time slotincluding one or more time-concurrent resource blocks (RBs) (alsoreferred to as physical RBs (PRBs)) in the frequency domain. Theresource grid is further divided into multiple resource elements (REs).An RE may correspond to one symbol length in the time domain and onesubcarrier in the frequency domain. In the numerology of FIGS. 4A to 4D,for a normal cyclic prefix, an RB may contain 12 consecutive subcarriersin the frequency domain and seven consecutive symbols in the timedomain, for a total of 84 REs. For an extended cyclic prefix, an RB maycontain 12 consecutive subcarriers in the frequency domain and sixconsecutive symbols in the time domain, for a total of 72 REs. Thenumber of bits carried by each RE depends on the modulation scheme.

Some of the REs carry downlink reference (pilot) signals (DL-RS). TheDL-RS may include PRS, TRS, PTRS, CRS, CSI-RS, DMRS, PSS, SSS, SSB, etc.FIG. 4A illustrates example locations of REs carrying PRS (labeled “R”).

A collection of resource elements (REs) that are used for transmissionof PRS is referred to as a “PRS resource.” The collection of resourceelements can span multiple PRBs in the frequency domain and ‘N’ (such as1 or more) consecutive symbol(s) within a slot in the time domain. In agiven OFDM symbol in the time domain, a PRS resource occupiesconsecutive PRBs in the frequency domain.

The transmission of a PRS resource within a given PRB has a particularcomb size (also referred to as the “comb density”). A comb size ‘N’represents the subcarrier spacing (or frequency/tone spacing) withineach symbol of a PRS resource configuration. Specifically, for a combsize ‘N,’ PRS are transmitted in every Nth subcarrier of a symbol of aPRB. For example, for comb-4, for each symbol of the PRS resourceconfiguration, REs corresponding to every fourth subcarrier (such assubcarriers 0, 4, 8) are used to transmit PRS of the PRS resource.Currently, comb sizes of comb-2, comb-4, comb-6, and comb-12 aresupported for DL-PRS. FIG. 4A illustrates an example PRS resourceconfiguration for comb-6 (which spans six symbols). That is, thelocations of the shaded REs (labeled “R”) indicate a comb-6 PRS resourceconfiguration.

Currently, a DL-PRS resource may span 2, 4, 6, or 12 consecutive symbolswithin a slot with a fully frequency-domain staggered pattern. A DL-PRSresource can be configured in any higher layer configured downlink orflexible (FL) symbol of a slot. There may be a constant energy perresource element (EPRE) for all REs of a given DL-PRS resource. Thefollowing are the frequency offsets from symbol to symbol for comb sizes2, 4, 6, and 12 over 2, 4, 6, and 12 symbols. 2-symbol comb-2: {0, 1};4-symbol comb-2: {0, 1, 0, 1}; 6-symbol comb-2: {0, 1, 0, 1, 0, 1};12-symbol comb-2: {0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1}; 4-symbol comb-4:{0, 2, 1, 3}; 12-symbol comb-4: {0, 2, 1, 3, 0, 2, 1, 3, 0, 2, 1, 3};6-symbol comb-6: {0, 3, 1, 4, 2, 5}; 12-symbol comb-6: {0, 3, 1, 4, 2,5, 0, 3, 1, 4, 2, 5}; and 12-symbol comb-12: {0, 6, 3, 9, 1, 7, 4, 10,2, 8, 5, 11}.

A “PRS resource set” is a set of PRS resources used for the transmissionof PRS signals, where each PRS resource has a PRS resource ID. Inaddition, the PRS resources in a PRS resource set are associated withthe same TRP. A PRS resource set is identified by a PRS resource set IDand is associated with a particular TRP (identified by a TRP ID). Inaddition, the PRS resources in a PRS resource set have the sameperiodicity, a common muting pattern configuration, and the samerepetition factor (such as “PRS-ResourceRepetitionFactor”) across slots.The periodicity is the time from the first repetition of the first PRSresource of a first PRS instance to the same first repetition of thesame first PRS resource of the next PRS instance. The periodicity mayhave a length selected from 2{circumflex over ( )}μ*{4, 5, 8, 10, 16,20, 32, 40, 64, 80, 160, 320, 640, 1280, 2560, 5120, 10240} slots, withμ=0, 1, 2, 3. The repetition factor may have a length selected from {1,2, 4, 6, 8, 16, 32} slots.

A PRS resource ID in a PRS resource set is associated with a single beam(or beam ID) transmitted from a single TRP (where a TRP may transmit oneor more beams). That is, each PRS resource of a PRS resource set may betransmitted on a different beam, and as such, a “PRS resource,” orsimply “resource,” also can be referred to as a “beam.” Note that thisdoes not have any implications on whether the TRPs and the beams onwhich PRS are transmitted are known to the UE.

A “PRS instance” or “PRS occasion” is one instance of a periodicallyrepeated time window (such as a group of one or more consecutive slots)where PRS are expected to be transmitted. A PRS occasion also may bereferred to as a “PRS positioning occasion,” a “PRS positioninginstance, a “positioning occasion,” “a positioning instance,” a“positioning repetition,” or simply an “occasion,” an “instance,” or a“repetition.”

A “positioning frequency layer” (also referred to simply as a “frequencylayer”) is a collection of one or more PRS resource sets across one ormore TRPs that have the same values for certain parameters.Specifically, the collection of PRS resource sets has the samesubcarrier spacing and cyclic prefix (CP) type (meaning all numerologiessupported for the PDSCH are also supported for PRS), the same Point A,the same value of the downlink PRS bandwidth, the same start PRB (andcenter frequency), and the same comb-size. The Point A parameter takesthe value of the parameter “ARFCN-ValueNR” (where “ARFCN” stands for“absolute radio-frequency channel number”) and is an identifier/codethat specifies a pair of physical radio channel used for transmissionand reception. The downlink PRS bandwidth may have a granularity of fourPRBs, with a minimum of 24 PRBs and a maximum of 272 PRBs. Currently, upto four frequency layers have been defined, and up to two PRS resourcesets may be configured per TRP per frequency layer.

The concept of a frequency layer is somewhat like the concept ofcomponent carriers and bandwidth parts (BWPs), but different in thatcomponent carriers and BWPs are used by one base station (or a macrocell base station and a small cell base station) to transmit datachannels, while frequency layers are used by several (usually three ormore) base stations to transmit PRS. A UE may indicate the number offrequency layers it can support when it sends the network itspositioning capabilities, such as during an LTE positioning protocol(LPP) session. For example, a UE may indicate whether it can support oneor four positioning frequency layers.

FIG. 4B illustrates an example of various channels within a downlinkslot of a radio frame. In NR, the channel bandwidth, or systembandwidth, is divided into multiple BWPs. A BWP is a contiguous set ofPRBs selected from a contiguous subset of the common RBs for a givennumerology on a given carrier. Generally, a maximum of four BWPs can bespecified in the downlink and uplink. That is, a UE can be configuredwith up to four BWPs on the downlink, and up to four BWPs on the uplink.Only one BWP (uplink or downlink) may be active at a given time, meaningthe UE may only receive or transmit over one BWP at a time. On thedownlink, the bandwidth of each BWP should be equal to or greater thanthe bandwidth of the SSB, but it may or may not contain the SSB.

Referring to FIG. 4B, a primary synchronization signal (PSS) is used bya UE to determine subframe/symbol timing and a physical layer identity.A secondary synchronization signal (SSS) is used by a UE to determine aphysical layer cell identity group number and radio frame timing. Basedon the physical layer identity and the physical layer cell identitygroup number, the UE can determine a PCI. Based on the PCI, the UE candetermine the locations of the aforementioned DL-RS. The physicalbroadcast channel (PBCH), which carries an MIB, may be logically groupedwith the PSS and SSS to form an SSB (also referred to as an SS/PBCH).The MIB provides a number of RBs in the downlink system bandwidth and asystem frame number (SFN). The physical downlink shared channel (PDSCH)carries user data, broadcast system information not transmitted throughthe PBCH, such as system information blocks (SIBs), and paging messages.

The physical downlink control channel (PDCCH) carries downlink controlinformation (DCI) within one or more control channel elements (CCEs),each CCE including one or more RE group (REG) bundles (which may spanmultiple symbols in the time domain), each REG bundle including one ormore REGs, each REG corresponding to 12 resource elements (one resourceblock) in the frequency domain and one OFDM symbol in the time domain.The set of physical resources used to carry the PDCCH/DCI is referred toin NR as the control resource set (CORESET). In NR, a PDCCH is confinedto a single CORESET and is transmitted with its own DMRS. This enablesUE-specific beamforming for the PDCCH.

In the example of FIG. 4B, there is one CORESET per BWP, and the CORESETspans three symbols (although it may be only one or two symbols) in thetime domain. Unlike LTE control channels, which occupy the entire systembandwidth, in NR, PDCCH channels are localized to a specific region inthe frequency domain (i.e., a CORESET). Thus, the frequency component ofthe PDCCH shown in FIG. 4B is illustrated as less than a single BWP inthe frequency domain. Note that although the illustrated CORESET iscontiguous in the frequency domain, it need not be. In addition, theCORESET may span less than three symbols in the time domain.

The DCI within the PDCCH carries information about uplink resourceallocation (persistent and non-persistent) and descriptions aboutdownlink data transmitted to the UE, referred to as uplink and downlinkgrants, respectively. More specifically, the DCI indicates the resourcesscheduled for the downlink data channel (e.g., PDSCH) and the uplinkdata channel (e.g., PUSCH). Multiple (e.g., up to eight) DCIs can beconfigured in the PDCCH, and these DCIs can have one of multipleformats. For example, there are different DCI formats for uplinkscheduling, for downlink scheduling, for uplink transmit power control(TPC), etc. A PDCCH may be transported by 1, 2, 4, 8, or 16 CCEs inorder to accommodate different DCI payload sizes or coding rates.

As illustrated in FIG. 4C, some of the REs (labeled “R”) carry DMRS forchannel estimation at the receiver (e.g., a base station, another UE,etc.). A UE may additionally transmit SRS in, for example, the lastsymbol of a slot. The SRS may have a comb structure, and a UE maytransmit SRS on one of the combs. In the example of FIG. 4C, theillustrated SRS is comb-2 over one symbol. The SRS may be used by a basestation to obtain the channel state information (CSI) for each UE. CSIdescribes how an RF signal propagates from the UE to the base stationand represents the combined effect of scattering, fading, and powerdecay with distance. The system uses the SRS for resource scheduling,link adaptation, massive MIMO, beam management, etc.

Currently, an SRS resource may span 1, 2, 4, 8, or 12 consecutivesymbols within a slot with a comb size of comb-2, comb-4, or comb-8. Thefollowing are the frequency offsets from symbol to symbol for the SRScomb patterns that are currently supported. 1-symbol comb-2: {0};2-symbol comb-2: {0, 1}; 4-symbol comb-2: {0, 1, 0, 1}; 4-symbol comb-4: {0, 2, 1, 3}; 8-symbol comb-4: {0, 2, 1, 3, 0, 2, 1, 3}; 12-symbolcomb-4: {0, 2, 1, 3, 0, 2, 1, 3, 0, 2, 1, 3}; 4-symbol comb-8: {0, 4, 2,6}; 8-symbol comb-8: {0, 4, 2, 6, 1, 5, 3, 7}; and 12-symbol comb-8: {0,4, 2, 6, 1, 5, 3, 7, 0, 4, 2, 6}.

A collection of resource elements that are used for transmission of SRSis referred to as an “SRS resource,” and may be identified by theparameter “SRS-ResourceId.” The collection of resource elements can spanmultiple PRBs in the frequency domain and N (e.g., one or more)consecutive symbol(s) within a slot in the time domain. In a given OFDMsymbol, an SRS resource occupies consecutive PRBs. An “SRS resource set”is a set of SRS resources used for the transmission of SRS signals, andis identified by an SRS resource set ID (“SRS-ResourceSetId”).

Generally, a UE transmits SRS to enable the receiving base station(either the serving base station or a neighboring base station) tomeasure the channel quality between the UE and the base station.However, SRS can also be specifically configured as uplink positioningreference signals for uplink-based positioning procedures, such asuplink time difference of arrival (UL-TDOA), round-trip-time (RTT),uplink angle-of-arrival (UL-AoA), etc. As used herein, the term “SRS”may refer to SRS configured for channel quality measurements or SRSconfigured for positioning purposes. The former may be referred toherein as “SRS-for-communication” and/or the latter may be referred toas “SRS-for-positioning” when needed to distinguish the two types ofSRS.

Several enhancements over the previous definition of SRS have beenproposed for SRS-for-positioning (also referred to as “UL-PRS”), such asa new staggered pattern within an SRS resource (except forsingle-symbol/comb-2), a new comb type for SRS, new sequences for SRS, ahigher number of SRS resource sets per component carrier, and a highernumber of SRS resources per component carrier. In addition, theparameters “SpatialRelationlnfo” and “PathLossReference” are to beconfigured based on a downlink reference signal or SSB from aneighboring TRP. Further still, one SRS resource may be transmittedoutside the active BWP, and one SRS resource may span across multiplecomponent carriers. Also, SRS may be configured in RRC connected stateand only transmitted within an active BWP. Further, there may be nofrequency hopping, no repetition factor, a single antenna port, and newlengths for SRS (e.g., 8 and 12 symbols). There also may be open-looppower control and not closed-loop power control, and comb-8 (i.e., anSRS transmitted every eighth subcarrier in the same symbol) may be used.Lastly, the UE may transmit through the same transmit beam from multipleSRS resources for UL-AoA. All of these are features that are additionalto the current SRS framework, which is configured through RRC higherlayer signaling (and potentially triggered or activated through MACcontrol element (CE) or DCI).

FIG. 4D illustrates an example of various channels within an uplink slotof a frame, according to aspects of the disclosure. A random-accesschannel (RACH), also referred to as a physical random-access channel(PRACH), may be within one or more slots within a frame based on thePRACH configuration. The PRACH may include six consecutive RB pairswithin a slot. The PRACH allows the UE to perform initial system accessand achieve uplink synchronization. A physical uplink control channel(PUCCH) may be located on edges of the uplink system bandwidth. ThePUCCH carries uplink control information (UCI), such as schedulingrequests, CSI reports, a channel quality indicator (CQI), a precodingmatrix indicator (PMI), a rank indicator (RI), and HARQ ACK/NACKfeedback. The physical uplink shared channel (PUSCH) carries data, andmay additionally be used to carry a buffer status report (BSR), a powerheadroom report (PHR), and/or UCI.

Note that the terms “positioning reference signal” and “PRS” generallyrefer to specific reference signals that are used for positioning in NRand LTE systems. However, as used herein, the terms “positioningreference signal” and “PRS” may also refer to any type of referencesignal that can be used for positioning, such as but not limited to, PRSas defined in LTE and NR, TRS, PTRS, CRS, CSI-RS, DMRS, PSS, SSS, SSB,SRS, UL-PRS, etc. In addition, the terms “positioning reference signal”and “PRS” may refer to downlink or uplink positioning reference signals,unless otherwise indicated by the context. If needed to furtherdistinguish the type of PRS, a downlink positioning reference signal maybe referred to as a “DL-PRS,” and an uplink positioning reference signal(e.g., an SRS-for- positioning, PTRS) may be referred to as an “UL-PRS.”In addition, for signals that may be transmitted in both the uplink anddownlink (e.g., DMRS, PTRS), the signals may be prepended with “UL” or“DL” to distinguish the direction. For example, “UL-DMRS” may bedifferentiated from “DL-DMRS.”

FIG. 5 is a diagram of an example PRS configuration 500 for the PRStransmissions of a given base station, according to aspects of thedisclosure. In FIG. 5, time is represented horizontally, increasing fromleft to right. Each long rectangle represents a slot and each short(shaded) rectangle represents an OFDM symbol. In the example of FIG. 5,a PRS resource set 510 (labeled “PRS resource set 1”) includes two PRSresources, a first PRS resource 512 (labeled “PRS resource 1”) and asecond PRS resource 514 (labeled “PRS resource 2”). The base stationtransmits PRS on the PRS resources 512 and 514 of the PRS resource set510.

The PRS resource set 510 has an occasion length (N_PRS) of two slots anda periodicity

(T_PRS) of, for example, 160 slots or 160 milliseconds (ms) (for 15 kHzsubcarrier spacing). As such, both the PRS resources 512 and 514 are twoconsecutive slots in length and repeat every T_PRS slots, starting fromthe slot in which the first symbol of the respective PRS resourceoccurs. In the example of FIG. 5, the PRS resource 512 has a symbollength (N_symb) of two symbols, and the PRS resource 514 has a symbollength (N_symb) of four symbols. The PRS resource 512 and the PRSresource 514 may be transmitted on separate beams of the same basestation.

Each instance of the PRS resource set 510, illustrated as instances 520a, 520 b, and 520 c, includes an occasion of length ‘2’ (i.e., N_PRS=2)for each PRS resource 512, 514 of the PRS resource set. The PRSresources 512 and 514 are repeated every T_PRS slots up to the mutingsequence periodicity T_REP. As such, a bitmap of length T_REP would beneeded to indicate which occasions of instances 520 a, 520 b, and 520 cof PRS resource set 610 are muted (i.e., not transmitted).

In an aspect, there may be additional constraints on the PRSconfiguration 500. For example, for all PRS resources (e.g., PRSresources 512, 514) of a PRS resource set (e.g., PRS resource set 510),the base station can configure the following parameters to be the same:(a) the occasion length (T_PRS), (b) the number of symbols (N_symb), (c)the comb type, and/or (d) the bandwidth. In addition, for all PRSresources of all PRS resource sets, the subcarrier spacing and thecyclic prefix can be configured to be the same for one base station orfor all base stations. Whether it is for one base station or all basestations may depend on the UE's capability to support the first and/orsecond option.

FIG. 6 is a diagram of example PRS resource sets having different timegaps, according to aspects of the disclosure. In the example of FIG. 6,time is represented horizontally and frequency is representedvertically. Each block represents a slot in the time domain and somebandwidth in the frequency domain.

FIG. 6 illustrates two DL-PRS resource set configurations, a firstDL-PRS resource set configuration 610 and a second DL-PRS resource setconfiguration 650. Each DL-PRS resource set configuration 610 and 650comprises four PRS resources (labeled “Resource 1,” “Resource 2,”“Resource 3,” and “Resource 4”) and has a repetition factor of four. Arepetition factor of four means that each of the four PRS resources isrepeated four times (i.e., is transmitted four times) within the DL-PRSresource set. That is, there are four repetitions of each of the fourPRS resources within the DL-PRS resource set.

The DL-PRS resource set configuration 610 has a time gap of one slot,meaning that each repetition of a PRS resource (e.g., “Resource 1”)starts on the first slot after the previous repetition of that PRSresource. Thus, as illustrated by DL-PRS resource set configuration 610,the four repetitions of each of the four PRS resources are groupedtogether. Specifically, the four repetitions of PRS resource “Resource1” occupy the first four slots (i.e., slots n to n+3) of the DL-PRSresource set configuration 610, the four repetitions of PRS resource“Resource 2” occupy the second four slots (i.e., slots n+4 to n+7), thefour repetitions of PRS resource “Resource 3” occupy the third fourslots (i.e., slots n+8 to n+11), and the four repetitions of PRSresource “Resource 4” occupy the last four slots (i.e., slots n+12 ton+15).

In contrast, the DL-PRS resource set configuration 650 has a time gap offour slots, meaning that each repetition of a PRS resource (e.g.,“Resource 2”) starts on the fourth slot after the previous repetition ofthat PRS resource. Thus, as illustrated by DL-PRS resource setconfiguration 650, the four repetitions of each of the four PRSresources are scheduled every fourth slot. For example, the fourrepetitions of PRS resource “Resource 1” occupy the first, fifth, ninth,and thirteenth slots (i.e., slots n, n+4, n+8, and n+12) of the DL-PRSresource set configuration 650.

Note that the time duration spanned by one DL-PRS resource setcontaining repeated DL-PRS resources, as illustrated in FIG. 6, shouldnot exceed the PRS periodicity. In addition, UE receive beam sweeping,for receiving/measuring the DL-PRS resource set, is not specified, butrather, depends on UE implementation.

FIGS. 7A and 7B illustrate various comb patterns supported for DL-PRSwithin a resource block. In FIGS. 7A and 7B, time is representedhorizontally and frequency is represented vertically. Each large blockin FIGS. 7A and 7B represents a resource block and each small blockrepresents a resource element. As discussed above, a resource elementconsists of one symbol in the time domain and one subcarrier in thefrequency domain. In the example of FIGS. 7A and 7B, each resource blockcomprises 14 symbols in the time domain and 12 subcarriers in thefrequency domain. The shaded resource elements carry, or are scheduledto carry, DL-PRS. As such, the shaded resource elements in each resourceblock correspond to a PRS resource, or the portion of the PRS resourcewithin one resource block (since a PRS resource can span multipleresource blocks in the frequency domain).

The illustrated comb patterns correspond to various DL-PRS comb patternsdescribed above. Specifically, FIG. 7A illustrates a DL-PRS comb pattern710 for comb-2 with two symbols, a DL-PRS comb pattern 720 for comb-4with four symbols, a DL-PRS comb pattern 730 for comb-6 with sixsymbols, and a DL-PRS comb pattern 740 for comb-12 with 12 symbols. FIG.7B illustrates a DL-PRS comb pattern 750 for comb-2 with 12 symbols, aDL-PRS comb pattern 760 for comb-4 with 12 symbols, a DL-PRS combpattern 770 for comb-2 with six symbols, and a DL-PRS comb pattern 780for comb-6 with 12 symbols.

Note that in the example comb patterns of FIG. 7A, the resource elementson which the DL-PRS are transmitted are staggered in the frequencydomain such that there is only one such resource element per subcarrierover the configured number of symbols. For example, for DL-PRS combpattern 720, there is only one resource element per subcarrier over thefour symbols. This is referred to as “frequency domain staggering.”

Further, there is some DL-PRS resource symbol offset (given by theparameter “DL-PRS-ResourceSymbolOffset”) from the first symbol of aresource block to the first symbol of the DL-PRS resource. In theexample of DL-PRS comb pattern 710, the offset is three symbols. In theexample of DL-PRS comb pattern 720, the offset is eight symbols. In theexamples of DL-PRS comb patterns 730 and 740, the offset is two symbols.In the examples of DL-PRS comb pattern 750 to 780, the offset is twosymbols.

As will be appreciated, a UE would need to have higher capabilities tomeasure the DL-PRS comb pattern 710 than to measure the DL-PRS combpattern 720, as the UE would have to measure resource elements on twiceas many subcarriers per symbol for DL-PRS comb pattern 710 as for DL-PRScomb pattern 720. In addition, a UE would need to have highercapabilities to measure the DL-PRS comb pattern 730 than to measure theDL-PRS comb pattern 740, as the UE will have to measure resourceelements on twice as many subcarriers per symbol for DL-PRS comb pattern730 as for DL-PRS comb pattern 740. Further, the UE would need to havehigher capabilities to measure the DL-PRS comb patterns 710 and 720 thanto measure the DL-PRS comb patterns 730 and 740, as the resourceelements of DL-PRS comb patterns 710 and 720 are denser than theresource elements of DL-PRS comb patterns 730 and 740.

In NR, a scrambling identifier is defined per PRS resource, and apseudo-random QPSK sequence changes per OFDM symbol per slot. Forexample, in some NR systems, the pseudo-random sequence generator shallbe initialised with:

$c_{init} = {\left( {{2^{22}\left\lfloor \frac{n_{{ID},{seq}}^{PRS}}{1024} \right\rfloor} + {2^{10}\left( {{N_{symb}^{slot}n_{s,f}^{\mu}} + l + 1} \right)\left( {{2\left( {n_{{ID},{seq}}^{PRS}{mod}1024} \right)} + 1} \right)} + \left( {n_{{ID},{seq}}^{PRS}{mod}1024} \right)} \right){mod}2^{31}}$

where n_(s,f) ^(μ) is the slot number, the downlink PRS sequence IDn_(ID,seq) ^(PRS) ϵ{0,1, . . . , 4095} is given by the higher-layerparameter dl-PRS-SequenceID-r16, and l is the OFDM symbol within theslot to which the sequence is mapped.

The above-noted parameters may be indicated to the UE viaNR-DL-PRS-Resource-r16, e.g.:

NR-DL-PRS-Resource-r16 ::= SEQUENCE {  NR-DL-PRS-Resource-r16 ::=SEQUENCE {  nr-DL-PRS-ResourceID-r16 NR-DL-PRS-ResourceID-r16, dl-PRS-SequenceID-r16 INTEGER (0.. 4095), dl-PRS-CombSizeN-AndReOffset-r16 CHOICE {   n2-r16 INTEGER (0..1),  n4-r16 INTEGER (0..3),   n6-r16 INTEGER (0..5),   n12-r16 INTEGER(0..11),   ...  },  dl-PRS-ResourceSlotOffset-r16 INTEGER(0..nrMaxResourceOffsetValue-  1-r16),  dl-PRS-ResourceSymbolOffset-r16INTEGER (0..12),  dl-PRS-QCL-Info-r16 DL-PRS-QCL-Info-r16  OPTIONAL, ... }

Ranging is supported in current Wi-Fi systems. Channel Estimates usingLong Training Fields (LTFs) can identify the first path even inmultipath environments, if the first path is not too weak (e.g., within10 dB of strongest path). IEEE 802.11az builds upon 802.11ax and is anIEEE project for secure ranging. One objective IEEE 802.11az is a secureLTF design. One of the main issues for secure LTFs is to avoid someonefrom spoofing the LTFs (e.g., making it look like the distance betweenthe two stations (STAs) is less than the actual distance).

Some examples of man-in-the-middle or “spoofing” attacks (e.g., some ofwhich may be characterized as “repetition-based” spoofing attacks) areas follows:

TABLE 1 Spoofing Attack Descriptions and Mitigation Techniques for IEEE802.11az Spoofing Attack Spoofing Attack Enhancement in Name DescriptionIEEE 802.11az Cyclic Prefix (CP) The Attacker listens to Remove the CPAttack the CP at the beginning (Zero Guard of one PRS symbol, OFDM) andtransmits a copy of the CP Noise Attack The Attacker transmits Check for(Jamming) noise. Sometimes, this consistency between will produce achannel repetitions for attack estimate with an detection. Thisartificially sooner path. particular attack type may not becharacterized as a “repetition-based” attack. Computational The Attackslistens to 64-QAM (frequency domain the initial part of the modulation,(FD)) Attack PRS, decodes it, and AES-128 Counter then send an Attack inmode, stream the second part of the cipher, in the PHY PRS for randompseudo bit generation, and/or Pre-stream phase rotation to reduceunintended beamforming Sample-by-sample The Attacker listens toFrequency domain (or minimum mean a portion of the PRS window: differentsquare error symbol and then windows make the (MMSE) or time- predicts afew future farther out domain (TD)) samples. Bandlimited predictionsmore Attack waveform, with difficult. autocorrelation between samples.

FIG. 8 illustrates a PRS spoofing attack 800 in accordance with anaspect of the disclosure. In FIG. 8, the PRS spoofing attack 800 of aPRS symbol or resource (e.g., potentially spanning multiple symbols)includes a listen phase 802, a compute phase 804 and an attack phase806. The attacker looks at the first part of the PRS during the listenphase 802. The attacker determines which QAM symbols are sent, and thenthe scrambling ID, during the compute phase 804. This is also known asFrequency-Domain (FD) attack. For an across-symbol attacker, theattacker receives a set of PRS symbols at 802, performs blind detectionof which scrambling ID was used at 804, and transmits the remaining PRSsymbols with some Timing Advance at 806. For a within-symbol attacker,the attacker is able to receive a part of just a single OFDM symbol at802, perform the FD or TD attack (computation or symbol-by-symbolattack) at 804, and transmit the remaining part of that single symbolwith a timing advance at 806.

FIG. 9 illustrates a PRS spoofing attack 900 in accordance with anaspect of the disclosure. In FIG. 9, the PRS spoofing attack 900 is asample-by-sample or TD attack, and includes a PRS symbol or resource(e.g., potentially spanning multiple symbols) includes a received signalphase 902, a time advancement 904, and a future signal 906. The timeadvancement 904 of the future signal 906 (or attack signal) may have aduration set to a number of samples, such as 3, 4, 5, etc. samples. Inthe PRS spoofing attack 900, the attacker receives a first part of thesignal at 902, determines the correlation (band- limited signal) andpredicts a few samples in the future at 906. A Wiener filter predictsthe future signal 906 by exploiting the correlation between the signalpreviously received at 902 and the future signal unreceived. This isalso known as a Time-Domain (TD) attack.

FIG. 10A illustrates a PRS spoofing attack 1000 in accordance with anaspect of the disclosure. In FIG. 10A, a PRS symbol (e.g., OFDM symbol)includes a CP 1002, a PRS part 1004 and a PRS ending part 1006. The CP1002 is identical to the PRS ending part 1006. Here, the attacks listensto the CP 1002, and then transmits a copy of the CP 1002 at 1008 in alater part of the PRS symbol.

FIG. 10B illustrates an example mitigation technique 1050 for counteringthe PRS spoofing attack 1000 of FIG. 10A in accordance with an aspect ofthe disclosure. In FIG. 10B, a PRS symbol (e.g., OFDM symbol) a PRS part1054 and a PRS ending part 1056. In FIG. 10B, the CP 1002 from FIG. 10Ais simply omitted altogether, such that the CP 1002 cannot be copied andtransmitted by the attacker. The mitigation technique 1050, which may bereferred to as a zero CP or zero guard interval (GI) technique, addscomplexity to the channel estimation.

Security of NR UE positioning is important for commercialization and mayenable more use cases. However, there is no PHY layer securitytechnologies for NR UE positioning in current 3GPP designs. The solutionof zero GI to deal with CP attack proposed for IEEE 802.11az may not beeasily adopted in 3GPP, as the fundamental waveform changes in NR specmakes such an implementation more challenging. Also, unlike 802.11az,there is some inherent repetition in NR PRS, even within a single PRSsymbol (e.g., which can be monitored by an attacker and copied, similarto CP). For example, for comb2/12 symbol PRS resource, the PRS symbolsare repeated 6 times. The attacker may thereby listen to the part of PRSresource and transmits a copy of the listened partial PRS resource withsome manipulation, for example with some small time advancement.

In many cases, attacks occur in the latter part of a PRS/SRS resource,as the attacker may need to receive the first part of the PRS/SRSresource before initiating an attack in the later part of the PRS/SRSresource. Based on this observation by the inventors of the subjectapplication, it is reasonable to assume that the first or beginning partis less likely to be attacked, and the corresponding measurement couldbe used for the attack detection. Another observation by the inventorsof the subject application is that the attack may be impulsive and withshort duration, hence the comparison of multiple partial PRS/SRSmeasurement could be used for attack detection.

Aspects of the disclosure are directed to spoofing attack detectionpartial measurement(s) of a reference signal for positioning (RS-P)(e.g., DL-PRS, UL-SRS-P, sidelink PRS, etc.). In some designs, thepartial measurement(s) of the RS-P may be measured across a subset ofRS-P symbols, such as the initial RS-P symbols and/or RS-P symbols in anearlier part of a respective RS-P resource. Such aspects may providevarious technical advantages, such as improved spoofing attack detectionwhich may improve positioning accuracy, network security, and so on.

FIG. 11 illustrates an exemplary process 1100 of wireless communication,according to aspects of the disclosure. In an aspect, the process 1100may be performed by a wireless node, such as UE 302 (e.g., a target UEfor which a positioning estimate is desired, an anchor or reference UEwith a known position from a recent positioning fix, etc.) or BS 304(e.g., a serving or non-serving gNB).

Referring to FIG. 11, at 1110, the wireless node (e.g., receiver 312 or322 or 352 or 362, processing system 332 or 384, etc.) performs a firstpartial measurement of a first measurement type of a reference signalfor positioning (RS-P) resource that includes multiple symbols, thefirst partial measurement being measured across a first subset of themultiple symbols. As will be described in more detail below, the firstpartial measurement may be measured across an initial subset ofcontiguous symbols or alternatively a subset of contiguous symbols thatstarts at a symbol later than the initial symbol of the RS-P resource.

Referring to FIG. 11, at 1120, the wireless node (e.g., transmitter 314or 324 or 354 or 364, network interface(s) 380, data bus 334 or 382etc.) transmits, to a communications device (e.g., a position estimationentity, a network component, etc.), a measurement report that includesan indication of the first partial measurement. In some designs, thewireless node itself may correspond to the communications device. Inthis case, the transmission at 1120 to this particular component maycorrespond to an internal transmission of data between logicalcomponents over a respective data bus, etc., rather than an externalwireless or backhaul transmission. In some designs, the communicationsdevice need not be a position estimation entity, but could correspond toanother type of network component (e.g., OEM server, application server,etc.).

FIG. 12 illustrates an exemplary process 1200 of wireless communication,according to aspects of the disclosure. In an aspect, the process 1200may be performed by a communications device, such as a positionestimation entity, which may correspond to a UE such as UE 302 (e.g.,for UE-based positioning), a BS or gNB such as BS 304 (e.g., for LMFintegrated in RAN), or a network entity 306 (e.g., core networkcomponent such as LMF). In other designs, the process 1200 may beperformed by another type of network component (e.g., not necessarily aposition estimation entity), such as an OEM server, application server,etc., to another UE, etc.

Referring to FIG. 12, at 1210, the communications device (e.g., receiver312 or 322 or 352 or 362, network interface(s) 380 or 390, data bus 334or 382, etc.) receives, from a wireless node, measurement report thatincludes an indication of a first partial measurement of a firstmeasurement type of a reference signal for positioning (RS-P) resourcethat includes multiple symbols, the first partial measurement beingmeasured by the wireless node across a first subset of the multiplesymbols. As will be described in more detail below, the first partialmeasurement may be measured across an initial subset of contiguoussymbols or alternatively a subset of contiguous symbols that starts at asymbol later than the initial symbol of the RS-P resource.

Referring to FIG. 12, at 1220, the communications device (e.g.,processing system 332 or 384 or 394, etc.) determines whether a spoofingattack is associated with the RS-P based at least in part upon themeasurement report. The determination of 1220 may be implemented in avariety of ways, as will be described below in more detail.

FIG. 13 illustrates an example implementation 1300 of the processes1100-1200 of FIGS. 11-12, respectively, in accordance with aspects ofthe disclosure. In FIG. 13, an RS-P resource (e.g., DL-PRS resource,UL-SRS-P resource, sidelink PRS resource, etc.) including symbols 1. . .N is depicted, each with symbol duration 1302. In FIG. 13, the firstsubset of symbols includes two or more contiguous symbols (i.e., symbols1-4) that begin at an initial symbol (i.e., symbol 1) of the RS-Presource. For example, for a comb-n PRS/SRS resource, UE/gNB could makean additional measurement on the first x (x<n) PRS/SRS symbol(s) withinthe resource.

FIG. 14 illustrates an example implementation 1400 of the processes1100-1200 of FIGS. 11-12, respectively, in accordance with aspects ofthe disclosure. In FIG. 14, an RS-P resource (e.g., DL-PRS resource,UL-SRS-P resource, sidelink PRS resource, etc.) including symbols 1. . .N is depicted, each with symbol duration 1402. In FIG. 14, the firstsubset of symbols includes two or more contiguous symbols (i.e., symbols2-5) that begin at a starting symbol (i.e., symbol 2) that is later thanan initial symbol (i.e., symbol 1) of the RS-P resource. For example,for a comb-n PRS/SRS resource, UE/gNB could make an additionalmeasurement on x (x<n) PRS/SRS symbol(s) within the resource, where x isnot the initial (or first) of the PRS/SRS symbol(s).

Referring to FIGS. 11-12, in some designs, the wireless node furtherperforms a full measurement of the first measurement type of the RS-Presource, the full measurement being measured across all symbols of theRS-P resource. In some designs, the measurement report at 1120 or 1210includes indications of both the first partial measurement and the fullmeasurement. In other words, an additional report element in the legacypositioning measurement report. For example, the same measurement type(i.e., for partial and full measurement) is assumed. For example, incase of RSTD for the full measurement, the first partial measurement maybe RSTD. In another example, in case of Rx-Tx time difference for thefull measurement, the first partial measurement may be Rx-Tx timedifference. In other designs, indications of the first partialmeasurement and the full measurement are communicated via separatemeasurement reports. In other words, a new additional measurement reportmay be defined based on the first partial PRS/SRS measurement. Like thelegacy measurement report, this additional measurement report couldinclude the TRP ID, resource ID and time stamp. The communicationsdevice (e.g., location server) could associate these two measurementreports based on these information. In some designs, there may be anadditional flag to indicate that this new ‘partial’ measurement reportis based on the x PRS/SRS symbols (e.g., the first x symbols or somecontiguous group of x symbols after the initial symbol of RS-Presource). In an example, the partial measurement report may include “x”to indicate, which symbol(s) are used to derive the additionalmeasurement. In some designs, the partial measurement report may addadditional measurement types (elements) to support advanced attackdetection, such as the PRS/SRS power delay profile (PDP), etc.

Referring to FIGS. 11-12, in some designs, the wireless node furtherperforms a second partial measurement of the first measurement type ofthe RS-P, the second partial measurement being measured across a secondsubset of the multiple symbols, the second subset of symbols beingdifferent than the first subset of symbols. For example, the firstpartial measurement may be measured across symbols 0-4 as in FIG. 13,while the second partial measurement may be measured across symbols 1-5as in FIG. 14. In some designs, a number of the first subset of symbolsis the same as a number of the second subset of symbols (e.g., 4symbols, as in the examples of FIGS. 13-14). In other designs, a numberof the first subset of symbols is different than a number of the secondsubset of symbols. In some designs, the measurement report at 1120 or1210 includes indications of both the first partial measurement and thesecond partial measurement. In other designs, indications of the firstpartial measurement and the second partial measurement are communicatedvia separate measurement reports.

Referring to FIGS. 11-12, in some designs, the wireless node itself maydetermine whether a spoofing attack is associated with the RS-P based atleast in part upon the first partial measurement. In other designs, thewireless node may transmit the measurement report without performing itsown analysis as to whether spoofing has been attempted by an attacker(e.g., the communications device may perform the analysis viacrowdsourcing of information across multiple measurement reports, etc.).In some designs, the wireless node and/or the communications device at1220 may detect whether there is a potential attack based on thecomparison between the measurement on the first partial PRS/SRS and thefull PRS/SRS measurement. For example, if the measurement based onpartial PRS/SRS is inconsistent with the measurement based on fullPRS/SRS, a potential attack may be detected. In some designs, to lowerthe false alarm rate, the attack detection may be based on some advancedalgorithms, such as machine learning. To support such advanced attackdetection, the additional partial measurement(s) could be reported tothe communications device (e.g., location server).

Referring to FIGS. 11-12, in some designs, the wireless node may performat least one additional partial measurement of a second measurement typeof the RS-P resource, the at least one additional partial measurementbeing measured across at least one subset of symbols of the multiplesymbols, and may further transmit at least one additional measurementreport that includes at least one additional indication of the at leastone additional partial measurement.

Referring to FIGS. 11-12, in some designs, partial measurements of thefirst measurement type may be performed for multiple RS-Ps, and thereporting of the partial measurements may be performed for less than allof the RS-Ps. For example, in some designs, the additional report onpartial PRS/SRS measurement may be sparse compared with the regularPRS/SRS (e.g., full RS-P measurements) to save UE power. To this end, insome designs, the reporting of the partial measurements may be performedperiodically, aperiodically, or semi-periodically.

Referring to FIGS. 11-12, in some designs, the measurement report iscommunicated from the wireless node to the communications device inresponse to an on-demand request (e.g., requested by UE for UE-basedpositioning, or requested by LMF, etc.). In some designs, the on-demandrequest is configured to request a single partial measurement indicationor multiple partial measurement indications. In some designs, theon-demand request specifies a number of the first subset of symbols, astarting symbol of the first subset of symbols, or a combinationthereof. In some designs, the on-demand request may be based on anadvanced attack detection algorithm running on the communications device(e.g., location server or UE) with large number of partial/full PRS/SRSmeasurements (e.g., a particular on-demand request for partial SRS/PRSmeasurement to check for potential spoofing attack may be based oncrowdsource analysis that indicates that a spoofing attack is likely).In some designs, the measurement report includes an indication of thefirst subset of symbols (e.g., symbols 0-4 in case of FIG. 13, symbols1-5 in case of FIG. 14, etc.),In some designs, the first measurementtype corresponds to a reference signal time difference (RSTD)measurement or a receive-transmit (Rx-Tx) time difference.

Referring to FIGS. 11-12, in some designs, the wireless node correspondsto a base station or a user equipment (UE). In some designs, the RS-Pcorresponds to a downlink positioning reference signal (DL-PRS), anuplink sounding reference signal for positioning (UL-SRS-P) or asidelink PRS (SL-PRS).

In the detailed description above it can be seen that different featuresare grouped together in examples. This manner of disclosure should notbe understood as an intention that the example clauses have morefeatures than are explicitly mentioned in each clause. Rather, thevarious aspects of the disclosure may include fewer than all features ofan individual example clause disclosed. Therefore, the following clausesshould hereby be deemed to be incorporated in the description, whereineach clause by itself can stand as a separate example. Although eachdependent clause can refer in the clauses to a specific combination withone of the other clauses, the aspect(s) of that dependent clause are notlimited to the specific combination. It will be appreciated that otherexample clauses can also include a combination of the dependent clauseaspect(s) with the subject matter of any other dependent clause orindependent clause or a combination of any feature with other dependentand independent clauses. The various aspects disclosed herein expresslyinclude these combinations, unless it is explicitly expressed or can bereadily inferred that a specific combination is not intended (e.g.,contradictory aspects, such as defining an element as both an insulatorand a conductor). Furthermore, it is also intended that aspects of aclause can be included in any other independent clause, even if theclause is not directly dependent on the independent clause.

Implementation examples are described in the following numbered clauses:

Clause 1. A method of operating a wireless node, comprising: performinga first partial measurement of a first measurement type of a referencesignal for positioning (RS-P) resource that includes multiple symbols,the first partial measurement being measured across a first subset ofthe multiple symbols; and transmitting a measurement report thatincludes an indication of the first partial measurement.

Clause 2. The method of clause 1, wherein the first subset of symbolsincludes two or more contiguous symbols that begin at an initial symbolof the RS-P resource.

Clause 3. The method of any of clauses 1 to 2, further comprising:performing a full measurement of the first measurement type of the RS-Presource, the full measurement being measured across all symbols of theRS-P resource.

Clause 4. The method of clause 3, wherein the measurement reportincludes indications of both the first partial measurement and the fullmeasurement.

Clause 5. The method of any of clauses 3 to 4, wherein indications ofthe first partial measurement and the full measurement are transmittedvia separate measurement reports.

Clause 6. The method of any of clauses 1 to 5, wherein the first subsetof symbols includes two or more contiguous symbols that begin at astarting symbol that is later than an initial symbol of the RS-Presource.

Clause 7. The method of any of clauses 1 to 6, further comprising:performing a second partial measurement of the first measurement type ofthe RS-P, the second partial measurement being measured across a secondsubset of the multiple symbols, the second subset of symbols beingdifferent than the first subset of symbols.

Clause 8. The method of clause 7, wherein a number of the first subsetof symbols is the same as a number of the second subset of symbols.

Clause 9. The method of any of clauses 7 to 8, wherein a number of thefirst subset of symbols is different than a number of the second subsetof symbols.

Clause 10. The method of any of clauses 7 to 9, wherein the measurementreport includes indications of both the first partial measurement andthe second partial measurement.

Clause 11. The method of any of clauses 7 to 10, wherein indications ofthe first partial measurement and the second partial measurement aretransmitted via separate measurement reports.

Clause 12. The method of any of clauses 1 to 11, further comprising:determining whether a spoofing attack is associated with the RS-P basedat least in part upon the first partial measurement.

Clause 13. The method of any of clauses 1 to 12, further comprising:performing at least one additional partial measurement of a secondmeasurement type of the RS-P resource, the at least one additionalpartial measurement being measured across at least one subset of symbolsof the multiple symbols; and transmitting at least one additionalmeasurement report that includes at least one additional indication ofthe at least one additional partial measurement.

Clause 14. The method of any of clauses 1 to 13, wherein partialmeasurements of the first measurement type are performed for multipleRS-Ps, and wherein reporting of the partial measurements is performedfor less than all of the RS-Ps.

Clause 15. The method of clause 14, wherein the reporting of the partialmeasurements is performed periodically, aperiodically, orsemi-periodically.

Clause 16. The method of any of clauses 1 to 15, wherein the measurementreport is transmitted in response to an on-demand request.

Clause 17. The method of clause 16, wherein the on-demand request isconfigured to request a single partial measurement indication ormultiple partial measurement indications.

Clause 18. The method of any of clauses 16 to 17, wherein the on-demandrequest specifies a number of the first subset of symbols, a startingsymbol of the first subset of symbols, or a combination thereof.

Clause 19. The method of any of clauses 1 to 18, wherein the measurementreport includes an indication of the first subset of symbols.

Clause 20. The method of any of clauses 1 to 19, wherein the firstmeasurement type corresponds to a reference signal time difference(RSTD) measurement or a receive-transmit (Rx-Tx) time difference.

Clause 21. The method of any of clauses 1 to 20, wherein the wirelessnode corresponds to a base station or a user equipment (UE).

Clause 22. The method of any of clauses 1 to 21, wherein the RS-Pcorresponds to a downlink positioning reference signal (DL-PRS), anuplink sounding reference signal for positioning (UL-SRS-P) or asidelink PRS (SL-PRS).

Clause 23. A method of operating a communications device, comprising:receiving, from a wireless node, a measurement report that includes anindication of a first partial measurement of a first measurement type ofa reference signal for positioning (RS-P) resource that includesmultiple symbols, the first partial measurement being measured by thewireless node across a first subset of the multiple symbols; anddetermining whether a spoofing attack is associated with the RS-P basedat least in part upon the measurement report.

Clause 24. The method of clause 23, wherein the first subset of symbolsincludes two or more contiguous symbols that begin at an initial symbolof the RS-P resource.

Clause 25. The method of any of clauses 23 to 24, wherein themeasurement report or a separate measurement report includes a fullmeasurement of the first measurement type of the RS-P resource, the fullmeasurement being measured by the wireless node across all symbols ofthe RS-P resource.

Clause 26. The method of clause 25, wherein the measurement reportincludes indications of both the first partial measurement and the fullmeasurement.

Clause 27. The method of any of clauses 25 to 26, wherein indications ofthe first partial measurement and the full measurement are received viathe measurement report and the separate measurement report,respectively.

Clause 28. The method of any of clauses 23 to 27, wherein the firstsubset of symbols includes two or more contiguous symbols that begin ata starting symbol that is later than an initial symbol of the RS-Presource.

Clause 29. The method of any of clauses 23 to 28, wherein themeasurement report or a separate measurement report includes anindication of a second partial measurement of the first measurement typeof the RS-P, the second partial measurement being measured across asecond subset of the multiple symbols, the second subset of symbolsbeing different than the first subset of symbols.

Clause 30. The method of clause 29, wherein a number of the first subsetof symbols is the same as a number of the second subset of symbols.

Clause 31. The method of any of clauses 29 to 30, wherein a number ofthe first subset of symbols is different than a number of the secondsubset of symbols.

Clause 32. The method of any of clauses 29 to 31, wherein themeasurement report includes indications of both the first partialmeasurement and the second partial measurement.

Clause 33. The method of any of clauses 29 to 32, wherein indications ofthe first partial measurement and the second partial measurement arereceived via the measurement report and the separate measurement report,respectively.

Clause 34. The method of any of clauses 23 to 33, further comprising:receiving at least one additional measurement report comprising at leastone additional indication of at least one additional partial measurementof a second measurement type of the RS-P resource, the at least oneadditional partial measurement being measured by the wireless nodeacross at least one subset of symbols of the multiple symbols.

Clause 35. The method of any of clauses 23 to 34, wherein partialmeasurements of the first measurement type are performed by the wirelessnode for multiple RS-Ps, and wherein reporting of the partialmeasurements is performed for less than all of the RS-Ps.

Clause 36. The method of clause 35, wherein the reporting of the partialmeasurements is performed periodically, aperiodically, orsemi-periodically.

Clause 37. The method of any of clauses 23 to 36, wherein themeasurement report is received in response to an on-demand request.

Clause 38. The method of clause 37, wherein the on-demand request isconfigured to request a single partial measurement indication ormultiple partial measurement indications.

Clause 39. The method of clause 38, wherein the on-demand requestspecifies a number of the first subset of symbols, a starting symbol ofthe first subset of symbols, or a combination thereof.

Clause 40. The method of any of clauses 23 to 39, wherein themeasurement report includes an indication of the first subset ofsymbols.

Clause 41. The method of any of clauses 23 to 40, wherein the firstmeasurement type corresponds to a reference signal time difference(RSTD) measurement or a receive-transmit (Rx-Tx) time difference.

Clause 42. The method of any of clauses 23 to 41, wherein the wirelessnode corresponds to a base station or a user equipment (UE).

Clause 43. The method of any of clauses 23 to 42, wherein the RS-Pcorresponds to a downlink positioning reference signal (DL-PRS), anuplink sounding reference signal for positioning (UL-SRS-P) or asidelink PRS (SL-PRS).

Clause 44. An apparatus comprising a memory, a communication interface,and at least one processor communicatively coupled to the memory and thecommunication interface, the memory, the communication interface, andthe at least one processor configured to perform a method according toany of clauses 1 to 43.

Clause 45. An apparatus comprising means for performing a methodaccording to any of clauses 1 to 43.

Clause 46. A non-transitory computer-readable medium storingcomputer-executable instructions, the computer-executable comprising atleast one instruction for causing a computer or processor to perform amethod according to any of clauses 1 to 43.

Those of skill in the art will appreciate that information and signalsmay be represented using any of a variety of different technologies andtechniques. For example, data, instructions, commands, information,signals, bits, symbols, and chips that may be referenced throughout theabove description may be represented by voltages, currents,electromagnetic waves, magnetic fields or particles, optical fields orparticles, or any combination thereof.

Further, those of skill in the art will appreciate that the variousillustrative logical blocks, modules, circuits, and algorithm stepsdescribed in connection with the aspects disclosed herein may beimplemented as electronic hardware, computer software, or combinationsof both. To clearly illustrate this interchangeability of hardware andsoftware, various illustrative components, blocks, modules, circuits,and steps have been described above generally in terms of theirfunctionality. Whether such functionality is implemented as hardware orsoftware depends upon the particular application and design constraintsimposed on the overall system. Skilled artisans may implement thedescribed functionality in varying ways for each particular application,but such implementation decisions should not be interpreted as causing adeparture from the scope of the present disclosure.

The various illustrative logical blocks, modules, and circuits describedin connection with the aspects disclosed herein may be implemented orperformed with a general purpose processor, a digital signal processor(DSP), an ASIC, a field-programable gate array (FPGA), or otherprogrammable logic device, discrete gate or transistor logic, discretehardware components, or any combination thereof designed to perform thefunctions described herein. A general-purpose processor may be amicroprocessor, but in the alternative, the processor may be anyconventional processor, controller, microcontroller, or state machine. Aprocessor may also be implemented as a combination of computing devices,for example, a combination of a DSP and a microprocessor, a plurality ofmicroprocessors, one or more microprocessors in conjunction with a DSPcore, or any other such configuration.

The methods, sequences and/or algorithms described in connection withthe aspects disclosed herein may be embodied directly in hardware, in asoftware module executed by a processor, or in a combination of the two.A software module may reside in random access memory (RAM), flashmemory, read-only memory (ROM), erasable programmable ROM (EPROM),electrically erasable programmable ROM (EEPROM), registers, hard disk, aremovable disk, a CD-ROM, or any other form of storage medium known inthe art. An example storage medium is coupled to the processor such thatthe processor can read information from, and write information to, thestorage medium. In the alternative, the storage medium may be integralto the processor. The processor and the storage medium may reside in anASIC. The ASIC may reside in a user terminal (e.g., UE). In thealternative, the processor and the storage medium may reside as discretecomponents in a user terminal.

In one or more example aspects, the functions described may beimplemented in hardware, software, firmware, or any combination thereof.If implemented in software, the functions may be stored on ortransmitted over as one or more instructions or code on acomputer-readable medium. Computer-readable media includes both computerstorage media and communication media including any medium thatfacilitates transfer of a computer program from one place to another. Astorage media may be any available media that can be accessed by acomputer. By way of example, and not limitation, such computer-readablemedia can comprise RAM, ROM, EEPROM, CD-ROM or other optical diskstorage, magnetic disk storage or other magnetic storage devices, or anyother medium that can be used to carry or store desired program code inthe form of instructions or data structures and that can be accessed bya computer. Also, any connection is properly termed a computer-readablemedium. For example, if the software is transmitted from a website,server, or other remote source using a coaxial cable, fiber optic cable,twisted pair, digital subscriber line (DSL), or wireless technologiessuch as infrared, radio, and microwave, then the coaxial cable, fiberoptic cable, twisted pair, DSL, or wireless technologies such asinfrared, radio, and microwave are included in the definition of medium.Disk and disc, as used herein, includes compact disc (CD), laser disc,optical disc, digital versatile disc (DVD), floppy disk and Blu-ray discwhere disks usually reproduce data magnetically, while discs reproducedata optically with lasers. Combinations of the above should also beincluded within the scope of computer-readable media.

While the foregoing disclosure shows illustrative aspects of thedisclosure, it should be noted that various changes and modificationscould be made herein without departing from the scope of the disclosureas defined by the appended claims. The functions, steps and/or actionsof the method claims in accordance with the aspects of the disclosuredescribed herein need not be performed in any particular order.Furthermore, although elements of the disclosure may be described orclaimed in the singular, the plural is contemplated unless limitation tothe singular is explicitly stated.

What is claimed is:
 1. A method of operating a wireless node,comprising: performing a first partial measurement of a firstmeasurement type of a reference signal for positioning (RS-P) resourcethat includes multiple symbols, the first partial measurement beingmeasured across a first subset of the multiple symbols; and transmittinga measurement report that includes an indication of the first partialmeasurement.
 2. The method of claim 1, wherein the first subset ofsymbols includes two or more contiguous symbols that begin at an initialsymbol of the RS-P resource.
 3. The method of claim 1, furthercomprising: performing a full measurement of the first measurement typeof the RS-P resource, the full measurement being measured across allsymbols of the RS-P resource.
 4. The method of claim 3, wherein themeasurement report includes indications of both the first partialmeasurement and the full measurement.
 5. The method of claim 3, whereinindications of the first partial measurement and the full measurementare transmitted via separate measurement reports.
 6. The method of claim1, wherein the first subset of symbols includes two or more contiguoussymbols that begin at a starting symbol that is later than an initialsymbol of the RS-P resource.
 7. The method of claim 1, furthercomprising: performing a second partial measurement of the firstmeasurement type of the RS-P, the second partial measurement beingmeasured across a second subset of the multiple symbols, the secondsubset of symbols being different than the first subset of symbols. 8.The method of claim 7, wherein a number of the first subset of symbolsis the same as a number of the second subset of symbols.
 9. The methodof claim 7, wherein a number of the first subset of symbols is differentthan a number of the second subset of symbols.
 10. The method of claim7, wherein the measurement report includes indications of both the firstpartial measurement and the second partial measurement.
 11. The methodof claim 7, wherein indications of the first partial measurement and thesecond partial measurement are transmitted via separate measurementreports.
 12. The method of claim 1, further comprising: determiningwhether a spoofing attack is associated with the RS-P based at least inpart upon the first partial measurement.
 13. The method of claim 1,further comprising: performing at least one additional partialmeasurement of a second measurement type of the RS-P resource, the atleast one additional partial measurement being measured across at leastone subset of symbols of the multiple symbols; and transmitting at leastone additional measurement report that includes at least one additionalindication of the at least one additional partial measurement.
 14. Themethod of claim 1, wherein partial measurements of the first measurementtype are performed for multiple RS-Ps, and wherein reporting of thepartial measurements is performed for less than all of the RS-Ps. 15.The method of claim 14, wherein the reporting of the partialmeasurements is performed periodically, aperiodically, orsemi-periodically.
 16. The method of claim 1, wherein the measurementreport is transmitted in response to an on-demand request.
 17. Themethod of claim 16, wherein the on-demand request is configured torequest a single partial measurement indication or multiple partialmeasurement indications.
 18. The method of claim 16, wherein theon-demand request specifies a number of the first subset of symbols, astarting symbol of the first subset of symbols, or a combinationthereof.
 19. The method of claim 1, wherein the measurement reportincludes an indication of the first subset of symbols.
 20. The method ofclaim 1, wherein the first measurement type corresponds to a referencesignal time difference (RSTD) measurement or a receive-transmit (Rx-Tx)time difference.
 21. A method of operating a communications device,comprising: receiving, from a wireless node, a measurement report thatincludes an indication of a first partial measurement of a firstmeasurement type of a reference signal for positioning (RS-P) resourcethat includes multiple symbols, the first partial measurement beingmeasured by the wireless node across a first subset of the multiplesymbols; and determining whether a spoofing attack is associated withthe RS-P based at least in part upon the measurement report.
 22. Themethod of claim 21, wherein the first subset of symbols includes two ormore contiguous symbols that begin at an initial symbol of the RS-Presource.
 23. The method of claim 21, wherein the measurement report ora separate measurement report includes a full measurement of the firstmeasurement type of the RS-P resource, the full measurement beingmeasured by the wireless node across all symbols of the RS-P resource.24. The method of claim 21, wherein the first subset of symbols includestwo or more contiguous symbols that begin at a starting symbol that islater than an initial symbol of the RS-P resource.
 25. The method ofclaim 21, wherein the measurement report or a separate measurementreport includes an indication of a second partial measurement of thefirst measurement type of the RS-P, the second partial measurement beingmeasured across a second subset of the multiple symbols, the secondsubset of symbols being different than the first subset of symbols. 26.The method of claim 21, further comprising: receiving at least oneadditional measurement report comprising at least one additionalindication of at least one additional partial measurement of a secondmeasurement type of the RS-P resource, the at least one additionalpartial measurement being measured by the wireless node across at leastone subset of symbols of the multiple symbols.
 27. The method of claim21, wherein partial measurements of the first measurement type areperformed by the wireless node for multiple RS-Ps, and wherein reportingof the partial measurements is performed for less than all of the RS-Ps.28. The method of claim 21, wherein the measurement report is receivedin response to an on-demand request.
 29. A wireless node, comprising: amemory; a communication interface; and at least one processorcommunicatively coupled to the memory and the communication interface,the at least one processor configured to: perform a first partialmeasurement of a first measurement type of a reference signal forpositioning (RS-P) resource that includes multiple symbols, the firstpartial measurement being measured across a first subset of the multiplesymbols; and cause the communication interface to transmit a measurementreport that includes an indication of the first partial measurement. 30.A communications device, comprising: a memory; a communicationinterface; and at least one processor communicatively coupled to thememory and the communication interface, the at least one processorconfigured to: receive, via the communication interface, from a wirelessnode, a measurement report that includes an indication of a firstpartial measurement of a first measurement type of a reference signalfor positioning (RS-P) resource that includes multiple symbols, thefirst partial measurement being measured by the wireless node across afirst subset of the multiple symbols; and determine whether a spoofingattack is associated with the RS-P based at least in part upon themeasurement report.